Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision Both sides next revision
litespeed_wiki:config:header-edit [2020/09/03 20:32]
Jackson Zhang 		litespeed_wiki:config:header-edit [2020/09/03 15:37] (current)
Jackson Zhang
Line 2: Line 2:
  
 LiteSpeed doesn'​t support Apache'​s header ''​edit''​ directive, and so the following Apache directive won't work on LiteSpeed: LiteSpeed doesn'​t support Apache'​s header ''​edit''​ directive, and so the following Apache directive won't work on LiteSpeed:
-  Header always edit Set-Cookie (.*) "​$1;​HTTPOnly;​Secure;​SameSite=none" +  Header always edit Set-Cookie (.*) "​$1;​HTTPOnly;​Secure"​
-  ​+
 ===== ''​secure''​ ===== ===== ''​secure''​ =====
 This particular case, which involves patching Set-Cookie with a ''​secure''​ flag when served over HTTPS, is automatically handled by LiteSpeed Web Server as of v5.4.5, and so it is unnecessary to use a directive for that. This particular case, which involves patching Set-Cookie with a ''​secure''​ flag when served over HTTPS, is automatically handled by LiteSpeed Web Server as of v5.4.5, and so it is unnecessary to use a directive for that.
Line 13: Line 12:
  </​code>​  </​code>​
  
-===== New directive ​''​ForceSecureCookie'' ​enforce "​secure"​ and "​SameSite"​ cookie attribute  ​===== +===== ''​SameSite''​===== 
-Starting from 5.4.9 build 2, a new directive ​''​ForceSecureCookie'' ​has been introduced ​to enforce "​secure"​ and "​SameSite"​ cookie attributes. It can be set in the Apache config file at the server or virtual host level, or in .htaccess of the document root directory. +For ''​SameSite=none'' ​attribute, there is no alternative way to do it on LiteSpeed at the time of this writing. It is better to be handled on the application ​level when the developer designs ​the site. 
- +
-''​ForceSecureCookie''​ can use value +
-  off, on|secure, lax|same_site_lax,​ strict|same_site_strict,​ same_site_none +
-   +
-''​same_site_xxxx''​ value can be combined with ''​secure''​. +
- +
-For example: +
-To enforce ''​secure''​ attribute only: +
-  ForceSecureCookie secure +
-   +
-To enforce "​secure;​ SameSite=none;"​ attribute:​ +
-  ForceSecureCookie secure same_site_none +
- +
-To enforce "​SameSite=strict"​ attribute only +
-  ForceSecureCookie strict +
-or +
-  ForceSecureCookie same_site_strict +
-   +
-When using the above directives, please make sure to enclose with  +
-  <​IfModule LiteSpeed>​ +
-  ​... +
-  </​IfModule>​+
  • Admin
  • Last modified: 2020/09/03 15:37
  • by Jackson Zhang