title: Define Same-site cookie in web.xml cookie-config for Tomcat
body: <p>I would want to add the <a href="https://caniuse.com/#feat=same-site-cookie-attribute" rel="noreferrer">Same-site cookie attribute</a> to the cookie I'm using in a Tomcat web app, to add the HttpOnly attribute it was enough adding the following definition in the web.xml file : </p>
  
  <pre><code>   &lt;session-config&gt;
      &lt;session-timeout&gt;240&lt;/session-timeout&gt;
      &lt;cookie-config&gt;
          &lt;http-only&gt;true&lt;/http-only&gt;
      &lt;/cookie-config&gt;
    &lt;/session-config&gt;
  </code></pre>
  
  <p>What about the Same-site attribute? Is it possible to set it in the same way as the http-only, like : <code>&lt;same-site&gt;true&lt;/same-site&gt;</code> ?</p>
  
  <p>A definition of the Same-site cookie :</p>
  
  <blockquote>
    <p>Same-site cookies (née "First-Party-Only" (née "First-Party")) allow
    servers to mitigate the risk of CSRF and information leakage attacks
    by asserting that a particular cookie should only be sent with
    requests initiated from the same registrable domain.</p>
  </blockquote>