Rack::Session::Cookie example please

[megazoic]

trafficstars

Firefox (76.0.1) gives me this error Cookie “rack.session” will be soon rejected because it has the “sameSite” attribute set to “none” or an invalid value, without the “secure” attribute. when I set up my config.ru with...

use Rack::Session::Cookie,
        :key          => 'rack.session', 
        :httponly     => true,
        :same_site    => :strict,
        :path         => '/',
        :expire_after => 86400,
        :secret       => ENV.fetch('SESSION_SECRET')

I'm not finding any substantive hits on a google search. Thanks for what you guys are doing!

[rowan-m]

I'm not super familiar with Rails, but looking around your configuration does look correct - as in, I would expect this to add SameSite=Strict to your Set-Cookie header. Can you check DevTools to see what attributes are set on the cookie? Can you also confirm the version of Rails that you are using? For example, support for SameSite=None was added somewhere around version 6.

[megazoic]

Thanks Rowan, and sorry for the delay in responding. It looks like as you said, the cookie is set for samesite strict. Not sure why Firefox is giving me this error in the console. My application is not rails but Ruby Sinatra running on Rack. I'll look into bringing this up on a Mozilla forum.