From maxleske at gmail.com  Tue Dec  1 20:18:06 2020
From: maxleske at gmail.com (Max Leske)
Date: Tue, 01 Dec 2020 21:18:06 +0100
Subject: [Seaside-dev] Cookie tracking and SameSite setting
In-Reply-To: <CAJMgPCJ5=swr114NrHpawRjEonOtBJOAiMJaLd4oHjt4hXKatA@mail.gmail.com>
References: <CAJMgPCJ5=swr114NrHpawRjEonOtBJOAiMJaLd4oHjt4hXKatA@mail.gmail.com>
Message-ID: <7E6223DD-6AEA-4D7B-BA43-52494281C515@gmail.com>

Hi Esteben,

Interesting case. I guess we didn't think about that. Usually you wouldn't want to share the tracking cookie with another domain but that might be a valid case

This should probably be solved by updating the configurations (which can be tough), so if you feel up to it we'd appreciate a PR with such a change.


Cheers,
Max

On 28 Nov 2020, at 19:25, Esteban Maringolo wrote:

> Hi all,
>
> I have an application that has a Cookie based tracking strategy, but
> given that the SameSite setting is hardcoded to be 'Strict' it forbids
> (and actually breaks) the behavior of my Seaside app when it is
> embedded into an <iframe> in a third party domain.
>
> Should this SameSite setting be configurable somehow?
>
> The only way I found to do this was by subclassing the tracking strategy class.
>
> Regards,
>
> Esteban A. Maringolo
> _______________________________________________
> seaside-dev mailing list
> seaside-dev at lists.squeakfoundation.org
> http://lists.squeakfoundation.org/mailman/listinfo/seaside-dev
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <http://lists.squeakfoundation.org/pipermail/seaside-dev/attachments/20201201/b06265e6/attachment.sig>

From emaringolo at gmail.com  Fri Dec  4 23:17:59 2020
From: emaringolo at gmail.com (Esteban Maringolo)
Date: Fri, 4 Dec 2020 20:17:59 -0300
Subject: [Seaside-dev] Cookie tracking and SameSite setting
In-Reply-To: <7E6223DD-6AEA-4D7B-BA43-52494281C515@gmail.com>
References: <CAJMgPCJ5=swr114NrHpawRjEonOtBJOAiMJaLd4oHjt4hXKatA@mail.gmail.com>
 <7E6223DD-6AEA-4D7B-BA43-52494281C515@gmail.com>
Message-ID: <CAJMgPCKLFMQqVzMriBkqnKYMNSNORk6-1xcV4G3xBsPUry-2WA@mail.gmail.com>

Hi Max,

I'll create the issue, at least as a reminder.

Regards!

Esteban A. Maringolo

On Tue, Dec 1, 2020 at 5:18 PM Max Leske <maxleske at gmail.com> wrote:
>
> Hi Esteben,
>
> Interesting case. I guess we didn't think about that. Usually you wouldn't want to share the tracking cookie with another domain but that might be a valid case
>
> This should probably be solved by updating the configurations (which can be tough), so if you feel up to it we'd appreciate a PR with such a change.
>
>
> Cheers,
> Max
>
> On 28 Nov 2020, at 19:25, Esteban Maringolo wrote:
>
> > Hi all,
> >
> > I have an application that has a Cookie based tracking strategy, but
> > given that the SameSite setting is hardcoded to be 'Strict' it forbids
> > (and actually breaks) the behavior of my Seaside app when it is
> > embedded into an <iframe> in a third party domain.
> >
> > Should this SameSite setting be configurable somehow?
> >
> > The only way I found to do this was by subclassing the tracking strategy class.
> >
> > Regards,
> >
> > Esteban A. Maringolo
> > _______________________________________________
> > seaside-dev mailing list
> > seaside-dev at lists.squeakfoundation.org
> > http://lists.squeakfoundation.org/mailman/listinfo/seaside-dev
> _______________________________________________
> seaside-dev mailing list
> seaside-dev at lists.squeakfoundation.org
> http://lists.squeakfoundation.org/mailman/listinfo/seaside-dev