title: How to set SameSite=None in JSESSIONID Cookie
body: <p>I have a spring boot API hosted at Heroku and when I try to access it via a Angular app in Google Chrome (In Firefox it works fine) I'm facing the following problem:</p>
  <p><a href="https://i.stack.imgur.com/CBEmk.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/CBEmk.png" alt="enter image description here" /></a></p>
  <p>It seems that the JSESSIONID cookie was blocked because it wasn't set to SameSite=None. But how can I set it as SameSite=None?</p>
  <p>The following are my configuration classes:</p>
  <p><strong>SecurityConfig:</strong></p>
  <pre class="lang-java prettyprint-override"><code>@Configuration
  @EnableWebSecurity
  @Order(SecurityProperties.DEFAULT_FILTER_ORDER)
  public class SecurityConfig extends WebSecurityConfigurerAdapter {
  
      @Autowired
      private ClienteUserDetailsService clienteUserDetailsService;
  
      private static final String[] PUBLIC_MATCHERS = {&quot;/login&quot;, &quot;/logout&quot;, &quot;/error.html&quot;, &quot;/error&quot;};
  
      private static final String[] PUBLIC_MATCHERS_GET = {&quot;/login&quot;, &quot;/logout&quot;, &quot;/error.html&quot;, &quot;/error&quot;};
  
      private static final String[] PUBLIC_MATCHERS_POST = {&quot;/login&quot;, &quot;/logout&quot;};
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
  
          http.csrf().disable()
                  .authorizeRequests()
                  .antMatchers(HttpMethod.POST, PUBLIC_MATCHERS_POST).permitAll()
                  .antMatchers(HttpMethod.GET, PUBLIC_MATCHERS_GET).permitAll()
                  .antMatchers(PUBLIC_MATCHERS).permitAll()
                  .antMatchers(HttpMethod.OPTIONS, &quot;/**&quot;).permitAll()
                  .anyRequest().authenticated()
                  .and().formLogin()
                  .and().httpBasic()
                  .and().logout().logoutUrl(&quot;/logout&quot;).logoutSuccessHandler((new HttpStatusReturningLogoutSuccessHandler(HttpStatus.OK)))
                  .clearAuthentication(true).invalidateHttpSession(true)
                  .deleteCookies(&quot;JSESSIONID&quot;, &quot;XSRF-TOKEN&quot;);
      }
  
      private CsrfTokenRepository getCsrfTokenRepository() {
          CookieCsrfTokenRepository tokenRepository = CookieCsrfTokenRepository.withHttpOnlyFalse();
          tokenRepository.setCookiePath(&quot;/&quot;);
          return tokenRepository;
      }
  
      @Override
      protected void configure(AuthenticationManagerBuilder builder) throws Exception {
          builder.userDetailsService(clienteUserDetailsService)
                  .passwordEncoder(passwordEncoder());
      }
  
      @Bean
      public WebMvcConfigurer corsConfigurer() {
          return new WebMvcConfigurerAdapter() {
              @Override
              public void addCorsMappings(CorsRegistry registry) {
                  registry.addMapping(&quot;**&quot;)
                          .allowedOrigins(&quot;http://localhost:4200&quot;, &quot;https://dogwalk-teste.web.app&quot;)
                          .allowedMethods(&quot;POST, GET, PUT, OPTIONS, DELETE, PATCH&quot;)
                          .allowCredentials(true);
              }
          };
      }
  
      @Bean
      public PasswordEncoder passwordEncoder() {
          return new BCryptPasswordEncoder();
      }
     
  
  }
  </code></pre>
  <p><strong>CorsFilter:</strong></p>
  <pre class="lang-java prettyprint-override"><code>@Component
  @Order(Ordered.HIGHEST_PRECEDENCE)
  public class CorsFilter implements Filter {
  
      @Context
      public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)
              throws IOException, ServletException {
  
          HttpServletRequest request = (HttpServletRequest) req;
          HttpServletResponse response = (HttpServletResponse) res;
  
          response.setHeader(&quot;Access-Control-Allow-Origin&quot;, request.getHeader(&quot;Origin&quot;));
          response.setHeader(&quot;Access-Control-Allow-Credentials&quot;, &quot;true&quot;);
          response.setHeader(&quot;Access-Control-Allow-Methods&quot;, &quot;POST, GET, PUT, OPTIONS, DELETE, PATCH&quot;);
          response.setHeader(&quot;Access-Control-Max-Age&quot;, &quot;3600&quot;);
          response.setHeader(&quot;Access-Control-Allow-Headers&quot;,
                  &quot;X-PINGOTHER, Content-Type, X-Requested-With, Accept, Origin, Access-Control-Request-Method, &quot;
                  + &quot;Access-Control-Request-Headers, Authorization, if-modified-since, remember-me, &quot;
                  + &quot;x-csrf-token, x-xsrf-token, xsrf-token &quot;);
          response.addHeader(&quot;Access-Control-Expose-Headers&quot;, &quot;xsrf-token&quot;);
          response.addHeader(&quot;Access-Control-Allow-Headers&quot;, &quot;x-csrf-token, x-xsrf-token&quot;);
          response.setHeader(&quot;Set-Cookie&quot;, &quot;locale=pt-BR; HttpOnly; Secure; SameSite=None;&quot;);
  
          chain.doFilter(req, res);
      }
  
      @Override
      public void init(FilterConfig filterConfig) throws ServletException {
      }
  
      @Override
      public void destroy() {
      }
  }
  </code></pre>