SameSite attribute missing in cookies

[luma7]

Hi,
after migrating some application with activerecord-session_store from Rails 6.1.7 to 7.1.3.4, the SameSite attribute is missing in cookies:

curl -v http://localhost:3000
...
< set-cookie: _cta_session=9f0ec74db42eb11e0434f81fc257c348; path=/; httponly
...

I was expecting "SameSite=Lax" which is the default for Rails applications according to https://guides.rubyonrails.org/configuring.html#config-action-dispatch-cookies-same-site-protection:

< set-cookie: _cta_session=9f0ec74db42eb11e0434f81fc257c348; path=/; httponly; SameSite=Lax

It's the same issue with versions 2.0.0 and 2.1.0 of activerecord-session_store, and it's working with https://api.rubyonrails.org/classes/ActionDispatch/Session/CookieStore.html.

Steps to reproduce:

rails new cookies_test_app
cd cookies_test_app
rails generate controller Some

// app/controllers/some_controller.rb:
class SomeController < ApplicationController
  def index
    session[:something] = true
    render plain: "hi there"
  end
end

// add to config/routes.rb:
root "some#index"

// add to Gemfile:
gem 'activerecord-session_store'

// execute migrations
rails db:migrate

// config/session_store.rb:
CookiesTestApp::Application.config.session_store :active_record_store, key: '_cta_session', secure: Rails.env.production?

And then see "set-cookie" in the result of "curl -v http://localhost:3000".

[lcmen]

From my understanding an initializer needs to be added to ActionDispatch::Session::ActiveRecordStore class.

Similar to https://github.com/rails/rails/blob/main/actionpack/lib/action_dispatch/middleware/session/cookie_store.rb#L64

def initialize(app, options = {})
  options[:same_site] = DEFAULT_SAME_SITE unless options.key?(:same_site)
  super
end

For the time being, I guess the workaround is to monkey patch the middleware?

# config/initializer/activerecord_session_store.rb
DEFAULT_SAME_SITE = proc { |request| request.cookies_same_site_protection }

ActionDispatch::Session::ActiveRecordStore.class_eval do
  def initialize(app, options = {})
    options[:same_site] = DEFAULT_SAME_SITE unless options.key?(:same_site)
    super
  end
end

[luma7]

That's working, thanks!

[stevenharman]

We're hitting this too and I agree with @lcmen - ActionDispatch::Session::ActiveRecordStore passes along whatever options it was configure with, and by default that DOES NOT include a :same_site value. So when Rack::Session::SessionId is created, it's defaulting :same_site to nil because the option is missing. That means, by the time ActionDispatch's cookie middleware runs, there is a :same_site key, so it won't set the default.

So yes, the monkey patch does work, or you could set the same_site: :lax (or whatever value you want) in your activerecord-session_store initializer.