Class SameSiteCookiesFilter

Sets in the HTTP response some Set-Cookie headers with a SameSite=None attribute for each shared cookie and each path of delegated UIs and previews of the product.

This filter aims at filtering only the paths on which a login form is involved, where a session cookie (or more generally a shared cookie) is created. The application administrator has the capability to extend the scope of the filter through a dedicated setting, so that all paths of the application are filtered. This is notably useful if a given customer is using a custom login page (with a dedicated path), which cannot be natively declared by the filter.

Here are the steps to correctly use this filter:

1. Register the filter for all URLs of the application, using <url-pattern>.
2. Declare the paths for the login pages of the application, using <init-param> with "loginPaths" as parameter name and a comma-separated value.
3. At application initialization phase, configure the default Shared Cookies and delegated UI paths with the SameSiteCookies class.

Here is an extract of filter declaration:

 <url-pattern>/*</url-pattern>
 <init-param>
      <param-name>loginPaths</param-name>
      <param-value>/path1/login.jsp,/path2/other-login</param-value>
 </init-param>