SameSite cookies with RestEasy Classic and Reactive

[brunolmfg]

Hi folks!

I've tried use the SameSite cookies feature but discovered that RestEasy Classic and Reactive generate the Set-Cookie header directly, avoiding the processing in VertxHttpRecorder handlers.

Is there any other approach using RestEasy Classic or Reactive to provide SameSite cookies?

[sberyozkin]

Hi, what is the side effect that you are observing ?

[brunolmfg]

The SameSite configuration has no effect using RestEasy when creating cookies using JAX-RS or RestEasy Reactive alternative types. The cookies doesn't receive the SameSite definition on VertxHttpRecorder handlers because RestEasy create the Set-Cookie header instead of passing the supposed and expected cookies types to Vertx HTTP.

[sberyozkin]

@brunolmfg Would it make sense then to add the same site parameter when creating a cookie from the code ?

[brunolmfg]

The JAX-RS 2.1 doesn't provide SameSite parameter yet but planned in Jakarta REST 3.1.

The possible cookie parameters using javax.ws.rs.core.NewCookie are:

    /**
     * Create a new instance.
     *
     * @param name     the name of the cookie
     * @param value    the value of the cookie
     * @param path     the URI path for which the cookie is valid
     * @param domain   the host domain for which the cookie is valid
     * @param version  the version of the specification to which the cookie complies
     * @param comment  the comment
     * @param maxAge   the maximum age of the cookie in seconds
     * @param expiry   the cookie expiry date.
     * @param secure   specifies whether the cookie will only be sent over a secure connection
     * @param httpOnly if {@code true} make the cookie HTTP only, i.e. only visible as part of an HTTP request.
     * @throws IllegalArgumentException if name is {@code null}.
     * @since 2.0
     */
    public NewCookie(String name,
                     String value,
                     String path,
                     String domain,
                     int version,
                     String comment,
                     int maxAge,
                     Date expiry,
                     boolean secure,
                     boolean httpOnly) {
        (...)
    }

The following is an example defining a JAX-RS resource responding with a simple cookie:

@Path("/cookie")
public class CookieResource {

    @GET
    @Produces(MediaType.TEXT_PLAIN)
    public Response getCookie() {
        return Response.ok()
                .cookie(new NewCookie("cookie", "hello"))
                .build();
    }

}

In application.properties defining the SameSite parameter as Strict for any cookie:

quarkus.http.same-site-cookie.".*".value=Strict

When requesting the corresponding endpoint:

$ curl -v http://localhost:8080/cookie

*   Trying 127.0.0.1:8080...
* TCP_NODELAY set
* Connected to localhost (127.0.0.1) port 8080 (#0)
> GET /auth/ HTTP/1.1
> Host: localhost:8080
> User-Agent: curl/7.68.0
> Accept: */*
> 
* Mark bundle as not supporting multiuse
< HTTP/1.1 200 OK
< Content-Type: text/plain;charset=UTF-8
< Set-Cookie: cookie=hello;Version=1
< content-length: 0
< 

Using Reactive Route or Vert.x Handler the SameSite parameter is appended.

[brunolmfg]

The workaround using the JAX-RS API will be creating the Set-Cookie header directly when building the response:

@Path("/cookie")
public class CookieResource {

    @GET
    @Produces(MediaType.TEXT_PLAIN)
    public Response getCookie() {
        return Response.ok()
                .header("Set-Cookie", "cookie=hello;Version=1;SameSite=Strict")
                .build();
    }

}

[sberyozkin]

@brunolmfg Yeah, good point; well, this is a workaround which works, I'm not sure RestEasy can be made aware of the Quarkus same site cookie configuration.

[brunolmfg]

I've assumed that when reading the documentation about SameSite cookies. 😅

[luca-bassoricci]

I had the same problem and I resolved adding cookies to active RoutingContext; in this way same-site configuration is applied accordingly; also io.vertx.core.http.impl.CookieImpl support same-site property if you want to hardcode the value.

@Path("/cookie")
public class CookieResource {
    @Inject
    RoutingContext routingContext;

    @GET
    @Produces(MediaType.TEXT_PLAIN)
    public Response getCookie() {
        routingContext.response()
            .addCookie(new io.vertx.core.http.impl.CookieImpl(...))
            .addCookie(new io.vertx.core.http.impl.CookieImpl(...));
        return Response.ok().build();
    }
}

[brunolmfg]

I resolved using io.vertx.core.http.Cookie. It's unnecessary use the CookieImpl.
The solution was something like this:

@Path("/cookie")
public class CookieResource {

    @GET
    @Produces(MediaType.TEXT_PLAIN)
    public Response getCookie() {
        var cookie = Cookie.cookie("cookie", "hello")
                .setSameSite(CookieSameSite.STRICT);

        return Response.ok()
                .header(HttpHeaders.SET_COOKIE, cookie.encode())
                .build();
    }
}

Using RoutingContext can be tricky with RESTEasy Reactive, but with Classic worked fine:

routingContext.response()
        .addCookie(Cookie.cookie("cookie", "hello"));

[luca-bassoricci]

Ok, I was missing Vertx Cookie factory method (I'll go to substitute my new after this message).
In few words, cookie created using Response.header(HttpHeaders.SET_COOKIE, cookie.encode()) are not processed by Quarkus same-site configuration, right?

[brunolmfg]

It's right. Only the ones added to HttpServerResponse via RoutingContext.