Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update docs for sameSite option #2019

Open
wants to merge 1 commit into
base: v1.x-2022-07
Choose a base branch
from
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
4 changes: 2 additions & 2 deletions docs/components/framework/cookie.md
Expand Up @@ -16,7 +16,7 @@ let cookie = new Cookie('__session', {
path: '/',
httpOnly: true,
secure: process.env.NODE_ENV === 'production',
sameSite: 'strict',
sameSite: 'Strict',
maxAge: 60 * 60 * 24 * 30,
});
cookie.parse(request.headers.get('cookie'));
Expand All @@ -36,7 +36,7 @@ The following table describes the options for how the cookie is persisted within
| maxAge | <code>number</code> | The [number of seconds until the cookie expires](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#max-agenumber). `maxAge` takes precedence over `expires` if both are defined. |
| secure | <code>boolean</code> | Whether to secure the cookie so that the browser only sends the cookie over HTTPS. Some browsers [don't work with secure cookies on localhost](https://owasp.org/www-community/controls/SecureCookieAttribute). |
| httpOnly | <code>boolean</code> | Whether to secure the cookie so that [client-side JavaScript can't read the cookie](https://owasp.org/www-community/HttpOnly). |
| sameSite | <code>"lax" &#124; "strict" &#124; "none"</code> | Declares that the cookie should be restricted to a first-party or [same-site](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite) context. |
| sameSite | <code>"Lax" &#124; "Strict" &#124; "None"</code> | Declares that the cookie should be restricted to a first-party or [same-site](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite) context. |
| path | <code>string</code> | Tells the browser that the cookie should only be sent to the server if it's within the [defined path](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#path_attribute). |
| domain | <code>string</code> | Secures the cookie so that it's only used on [specific domains](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#domain_attribute). |

Expand Down
2 changes: 1 addition & 1 deletion docs/components/framework/cookiesessionstorage.md
Expand Up @@ -19,7 +19,7 @@ export default defineConfig({
path: '/',
httpOnly: true,
secure: process.env.NODE_ENV === 'production',
sameSite: 'strict',
sameSite: 'Strict',
maxAge: 60 * 60 * 24 * 30,
}),
});
Expand Down
2 changes: 1 addition & 1 deletion docs/components/framework/filesessionstorage.md
Expand Up @@ -20,7 +20,7 @@ export default defineConfig({
path: '/',
httpOnly: true,
secure: process.env.NODE_ENV === 'production',
sameSite: 'strict',
sameSite: 'Strict',
maxAge: 60 * 60 * 24 * 30,
}),
});
Expand Down
2 changes: 1 addition & 1 deletion docs/components/framework/memorysessionstorage.md
Expand Up @@ -19,7 +19,7 @@ export default defineConfig({
path: '/',
httpOnly: true,
secure: process.env.NODE_ENV === 'production',
sameSite: 'strict',
sameSite: 'Strict',
maxAge: 60 * 60 * 24 * 30,
}),
});
Expand Down
2 changes: 1 addition & 1 deletion docs/framework/hydrogen-config.md
Expand Up @@ -170,7 +170,7 @@ export default defineConfig({
/* Whether to secure the cookie so that the browser only sends the cookie over HTTPS. */
secure: process.env.NODE_ENV === 'production',
/* Declares that the cookie should be restricted to a first-party or same-site context. */
sameSite: 'strict',
sameSite: 'Strict',
/* The number of seconds until the cookie expires. */
maxAge: 60 * 60 * 24 * 30,
}),
Expand Down