Tomcat 8.5.24 中为 JSESSIONID Cookie 添加 SameSite 属性

在 Tomcat 8.5.24 中，可以通过编写一个自定义的 Filter 来实现为默认的 JSESSIONID Cookie 增加 samesite 属性。\n\n以下是一个示例的 Filter 代码：\n\njava\nimport javax.servlet.*;\nimport javax.servlet.http.Cookie;\nimport javax.servlet.http.HttpServletRequest;\nimport javax.servlet.http.HttpServletResponse;\nimport java.io.IOException;\n\npublic class SameSiteFilter implements Filter {\n\n @Override\n public void init(FilterConfig filterConfig) throws ServletException {\n // 初始化操作\n }\n\n @Override\n public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {\n HttpServletRequest request = (HttpServletRequest) servletRequest;\n HttpServletResponse response = (HttpServletResponse) servletResponse;\n\n // 检查是否已经存在 JSESSIONID Cookie\n boolean cookieExists = false;\n Cookie[] cookies = request.getCookies();\n if (cookies != null) {\n for (Cookie cookie : cookies) {\n if (cookie.getName().equals("JSESSIONID")) {\n cookieExists = true;\n break;\n }\n }\n }\n\n // 如果不存在 JSESSIONID Cookie，则创建一个并设置 samesite 属性\n if (!cookieExists) {\n String sessionId = request.getSession().getId();\n Cookie cookie = new Cookie("JSESSIONID", sessionId);\n cookie.setHttpOnly(true);\n cookie.setPath("/");\n cookie.setSecure(request.isSecure());\n cookie.setSameSite("Strict"); // 设置 samesite 属性为 Strict\n response.addCookie(cookie);\n }\n\n // 继续处理其他 Filter 或 Servlet\n filterChain.doFilter(servletRequest, servletResponse);\n }\n\n @Override\n public void destroy() {\n // 销毁操作\n }\n}\n\n\n然后，在 web.xml 文件中配置该 Filter：\n\nxml\n<filter>\n <filter-name>sameSiteFilter</filter-name>\n <filter-class>com.example.SameSiteFilter</filter-class>\n</filter>\n<filter-mapping>\n <filter-name>sameSiteFilter</filter-name>\n <url-pattern>/*</url-pattern>\n</filter-mapping>\n\n\n以上代码将为所有请求自动添加 samesite 属性为 Strict 的 JSESSIONID Cookie。在实际项目中，你可能需要根据需要对 Filter 进行适当的修改和调整。