Package io.karatelabs.http

Enum Class SameSite

java.lang.Object

java.lang.Enum<SameSite>

io.karatelabs.http.SameSite

All Implemented Interfaces:

Serializable, Comparable<SameSite>, Constable

public enum SameSite
extends Enum<SameSite>

SameSite cookie attribute values per RFC 6265bis.

Used by ServerConfig.sessionSameSite(SameSite) to control whether the session cookie is attached on cross-site navigations.

• STRICT — never sent on any cross-site request. Strongest CSRF defense, but breaks OAuth callbacks (the IdP redirects back to your /signin?code=... and the browser drops the cookie).
• LAX — sent on top-level navigations using safe methods (GET). This is the framework default and works for OAuth callbacks that use response_mode=query, where the IdP issues a 302 GET back.
• NONE — sent on all cross-site requests, including top-level POSTs. Required for OAuth/OIDC flows that use response_mode=form_post (e.g. Microsoft / Azure AD via MSAL4J >= 1.18, which deprecated QUERY and force-overrides to FORM_POST). Implies Secure — the browser refuses SameSite=None cookies that lack Secure, so Secure is added automatically by ServerRequestHandler outside dev mode. Pair with explicit CSRF tokens (already enforced by CsrfProtection) since SameSite is no longer a defense layer.

Nested Class Summary

Nested classes/interfaces inherited from class java.lang.Enum

Enum.EnumDesc<E extends Enum<E>>

Enum Constant Summary

Enum Constants

Enum Constant	Description
LAX
NONE
STRICT

Method Summary

Modifier and Type	Method	Description
String	headerValue()	The exact attribute value to emit in the Set-Cookie header.
static SameSite	valueOf(String name)	Returns the enum constant of this class with the specified name.
static SameSite[]	values()	Returns an array containing the constants of this enum class, in the order they are declared.

Methods inherited from class java.lang.Enum

clone, compareTo, describeConstable, equals, finalize, getDeclaringClass, hashCode, name, ordinal, toString, valueOf

Methods inherited from class java.lang.Object

getClass, notify, notifyAll, wait, wait, wait

Enum Constant Details

STRICT

public static final SameSite STRICT

LAX

public static final SameSite LAX

NONE

public static final SameSite NONE

Method Details

values

public static SameSite[] values()

Returns an array containing the constants of this enum class, in the order they are declared.

Returns:

an array containing the constants of this enum class, in the order they are declared

valueOf

public static SameSite valueOf(String name)

Returns the enum constant of this class with the specified name. The string must match exactly an identifier used to declare an enum constant in this class. (Extraneous whitespace characters are not permitted.)

Parameters:

name - the name of the enum constant to be returned.

Returns:

the enum constant with the specified name

Throws:

IllegalArgumentException - if this enum class has no constant with the specified name

NullPointerException - if the argument is null

headerValue

public String headerValue()

The exact attribute value to emit in the Set-Cookie header.