Considering adding proprietary cookies good practices as Chrome make big changes on cookies in 2024

[teotimepacreau]

Prerequisites

• I have written a descriptive issue title
• I have searched existing issues to ensure the feature has not already been requested

🚀 Feature Proposal

Third party cookies won't be supported anymore as 2024 Chrome said

Chrome recommend good practices even for proprietary cookies to ensure it continues to work for session but for now theses options are unsupported in fastify-secure-session :

• secure: true
• __Host-cookie-name=cookie-value
• SameSite=Strict || Lax

Motivation

ensure session cookies for the plugin remain practicable

Example

app.register(fastifySecureSession, {
    **_secure: true,
    __Host-cookie-name=cookie-value
    SameSite=Strict_**
    cookieName: 'session',
    key: readFileSync(join(rootDir, 'secret-key')),
    cookie: {
        path: '/',
    }
})

[mcollina]

Thanks for reporting! Would you like to send a Pull Request to address this issue? Remember to add unit tests.

[Uzlopak]

If somebody wants to implement this feature request, he/she should orientate himself/herself on the following PR of @fastify/session.

fastify/session#226

[Tony133]

Closing this issue, the requested functionality is already fully supported today, no code changes needed. I checked the actual source of both @fastify/secure-session and @fastify/cookie to confirm:

secure: true and sameSite: 'strict' | 'lax'

The cookie option you pass to @fastify/secure-session is forwarded as-is to reply.setCookie():

// index.js (fastify-secure-session)
reply.setCookie(
  cookieName,
  fastify.encodeSecureSession(session, sessionName),
  Object.assign({}, cookieOptions, session[kCookieOptions])
)

...which natively supports both options (sameSite even defaults to 'lax', and secure accepts 'auto' to switch based on request protocol):

// index.js (fastify-cookie)
const opts = Object.assign({ sameSite: 'lax' }, options)
if (opts.secure === 'auto') {
  opts.secure = reply.request.protocol === 'https'
}

So this already works:

fastify.register(require('@fastify/secure-session'), {
  key: ...,
  cookie: {
    path: '/',
    secure: true,
    sameSite: 'strict'
  }
})

__Host- prefix

This isn't a plugin feature, it's a naming convention enforced by browsers. cookieName is just passed through as an arbitrary string, with no validation or special-casing. As long as the name starts with __Host-, secure: true is set, path: '/', and no domain is set, it already works:

fastify.register(require('@fastify/secure-session'), {
  key: ...,
  cookieName: '__Host-session',
  cookie: {
    path: '/',
    secure: true
  }
})

Since the actual gap seems to be documentation rather than functionality, I'll open a small PR adding an example that shows secure, sameSite, and the __Host- prefix combined, so future readers don't hit the same question.

If there's still something specific that doesn't work as expected with the above, please feel free to open a new issue with a reproduction and we'll take a look. 🙂