diff --git a/packages/browser-sync/lib/server/proxy-utils.js b/packages/browser-sync/lib/server/proxy-utils.js index ec03a8997..ac7be79b0 100644 --- a/packages/browser-sync/lib/server/proxy-utils.js +++ b/packages/browser-sync/lib/server/proxy-utils.js @@ -152,6 +152,16 @@ function rewriteCookies(rawCookie) { pairs.push("HttpOnly"); } + // SameSite=None must be declared as secure + // @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite#samesitenone_requires_secure + // @see https://chromestatus.com/feature/5633521622188032 + if ( + rawCookie.match(/[ ]secure(?:\;|$)/i) && + rawCookie.match(/[ ]SameSite=None(?:\;|$)/i) + ) { + pairs.push("secure"); + } + return pairs.join("; "); } diff --git a/packages/browser-sync/package.json b/packages/browser-sync/package.json index fbbe6bf01..482769f8b 100644 --- a/packages/browser-sync/package.json +++ b/packages/browser-sync/package.json @@ -30,6 +30,7 @@ "prettier": "prettier 'lib/**/*' 'examples/*' 'test/specs/**/*.js' --tab-width 4", "prettier:fix": "npm run prettier -- --write", "test": "npm run build && npm run env && npm run unit", + "test:watch": "npm run build && npm run env && mocha --recursive test/specs --watch", "unit": "mocha --recursive test/specs --timeout 10000 --bail --exit", "watch": "npm run build && npm run serve:fixtures", "serve:fixtures": "node dist/bin test/fixtures -w --no-open" diff --git a/packages/browser-sync/test/specs/server/server.proxyUtils.rewriteCookies.js b/packages/browser-sync/test/specs/server/server.proxyUtils.rewriteCookies.js new file mode 100644 index 000000000..3f3931399 --- /dev/null +++ b/packages/browser-sync/test/specs/server/server.proxyUtils.rewriteCookies.js @@ -0,0 +1,25 @@ +// jscs:disable maximumLineLength + +var rewriteCookies = require("../../../dist/server/proxy-utils").rewriteCookies; +var expect = require("chai").expect; + +describe("rewriteCookies spec", function() { + it("Should honor secure directive on SameSite=None cookies", function() { + var cookies = [ + "localization=US; path=/; expires=Fri, 03 Jun 2022 21:13:22 GMT; SameSite=Lax", + "localization=secure; path=/; expires=Fri, 03 Jun 2022 21:13:22 GMT; SameSite=Lax", + "storefront_digest=1234567; path=/; secure; HttpOnly; SameSite=None" + ]; + + var result = cookies.reduce((aggregate, cookie) => { + aggregate.push(rewriteCookies(cookie)); + return aggregate; + }, []); + + expect(result).to.deep.equal([ + "localization=US; path=/; expires=Fri, 03 Jun 2022 21:13:22 GMT; SameSite=Lax", + "localization=secure; path=/; expires=Fri, 03 Jun 2022 21:13:22 GMT; SameSite=Lax", + "storefront_digest=1234567; path=/; SameSite=None; HttpOnly; secure" + ]); + }); +});