SameSite attribute is not preserved

[nils-christian]

Hi,

The proxy copies cookies from the response in copyProxyCookie. It does so by parsing the header value and writing the (modified) cookie proxy in the HttpServletResponse object. However the SameSite attribute gets lost in this process.

As java.net.HttpCookie can not transport this information the proxy should parse the header for the SameSite attribute and adds it to the proxy via setAttribute.

Thank you and best regards

Nils

[nils-christian]

Hi,

Sorry for the duplicate entry.

I took another look at it. To fix this, one would probably need to upgrade the Servlet API from 5.0 to 6.0, because otherwise setAttribute is not available. I can provide a PR for this, but as this is a breaking change I would like to have an opinion on this first.

Thank you and best regards

Nils

[dsmiley]

See #247 . If we get that over the finish line then you'll have the ability to do this. Feel free to take some agency here... I'm mostly stewarding the project without doing much. Albeit I've got a big PR for switching to JDK HttpClient.

[nils-christian]

Hi @dsmiley ,

I added a PR. Disclaimer: I implemented the code with the help of Claude Code.

Basically it does the following:

• It bumps the Servlet API to 6.0.0. 5.0.0 is no longer supported thus we don't need to modify the test matrix as in your mentioned PR.
• It solves the original issue with the SameSite attribute.
• It updates the jetty-servlet for the test. This was necessary as the HtmlUnit based test would again remove the additional attributes. Thus we need to use the jetty servlet API directly, which in turn required an update of jetty-servlet.
• Most changes are a result of the jetty-servlet update.
• It mentions the Servlet API as well as the fix in the Readme file.
• It bumps the upcoming version to 3.0 instead of 2.1, as it is incompatible with the 5.0.0 servlet API.

Thank you and best regards

Nils

[nils-christian]

I added another PR due to the discussion regarding JDK 11 in #260. It replaces Jetty with Tomcat in order to use Servlet 6.0 but still JDK 11.