© 2026 Hedgehog Software, LLC
server.servlet.session.cookie.same-site=none server.servlet.session.cookie.http-only=true server.servlet.session.cookie.secure=true
@Bean TomcatContextCustomizer sessionCookieConfigForCors() { return context -> { final Rfc6265CookieProcessor cookieProcessor = new Rfc6265CookieProcessor() { @Override public String generateHeader(Cookie cookie, HttpServletRequest request) { // Needs to be secure if (cookie.getName().startsWith("JSESSIONID")) { cookie.setSecure(true); cookie.setPath("/"); cookie.setDomain("mydomain.eu"); cookie.setAttribute("SameSite", SameSiteCookies.NONE.getValue()); cookie.setHttpOnly(true); // cookie.setAttribute("Partitioned", "true"); } if (cookie.getName().startsWith("csrfToken")) { cookie.setSecure(true); cookie.setPath("/"); cookie.setDomain("mydomain.eu"); cookie.setAttribute("SameSite", SameSiteCookies.NONE.getValue()); cookie.setHttpOnly(true); // cookie.setAttribute("Partitioned", "true"); } return super.generateHeader(cookie, request); } }; context.setCookieProcessor(cookieProcessor); }; }