Fix Cookie SameSite constants to Pascal case per RFC specification #3608

Copilot · 2025-07-20T15:28:37Z

This PR fixes the Cookie SameSite constants to use proper Pascal case values as required by the RFC specification.

Problem

The Cookie SameSite constants were using lowercase values:

const (
    CookieSameSiteDisabled   = "disabled"
    CookieSameSiteLaxMode    = "lax"
    CookieSameSiteStrictMode = "strict" 
    CookieSameSiteNoneMode   = "none"
)

However, according to RFC 6265bis, the SameSite values should be Pascal case: "Strict" / "Lax" / "None".

Solution

Updated the constants to use RFC-compliant Pascal case:

const (
    CookieSameSiteDisabled   = "disabled" // unchanged - not part of RFC
    CookieSameSiteLaxMode    = "Lax"
    CookieSameSiteStrictMode = "Strict"
    CookieSameSiteNoneMode   = "None"
)

Also removed the utils.ToLower() call in ctx.go that was converting these values back to lowercase, ensuring the cookie headers output the correct Pascal case values.

Verification

All existing tests pass (1654 tests)
Manual verification confirms cookie headers now output: SameSite=Lax, SameSite=Strict, SameSite=None
The middleware components (CSRF, session) continue to work correctly

Fixes #3607.

Warning

Firewall rules blocked me from connecting to one or more addresses

I tried to connect to the following addresses, but was blocked by firewall rules:

exampleretry.com
- Triggering command: /tmp/go-build776519753/b273/client.test -test.paniconexit0 -test.v=test2json -test.timeout=10m0s -test.count=1 -test.shuffle=on (dns block)
- Triggering command: /tmp/go-build2352507060/b273/client.test -test.paniconexit0 -test.v=test2json -test.timeout=10m0s -test.count=1 -test.shuffle=on (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to my firewall allow list

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

Co-authored-by: sixcolors <[email protected]>

codecov · 2025-07-20T17:44:03Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.13%. Comparing base (96674dc) to head (e0c9952).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3608      +/-   ##
==========================================
+ Coverage   91.01%   91.13%   +0.11%     
==========================================
  Files         112      112              
  Lines       11290    11293       +3     
==========================================
+ Hits        10276    10292      +16     
+ Misses        756      744      -12     
+ Partials      258      257       -1

Flag	Coverage Δ
unittests	`91.13% <100.00%> (+0.11%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

github-actions

⚠️ Performance Alert ⚠️

Possible performance regression was detected for benchmark.
Benchmark result of this commit is worse than the previous benchmark result exceeding threshold 1.50.

Benchmark suite	Current: `653312e`	Previous: `361d76c`	Ratio
`Benchmark_GenericParseTypeString/benchmark_genericParseTypeString#02`	`13.56` ns/op 0 B/op 0 allocs/op	`9` ns/op 0 B/op 0 allocs/op	`1.51`
`Benchmark_GenericParseTypeString/benchmark_genericParseTypeString#02 - ns/op`	`13.56` ns/op	`9` ns/op	`1.51`

This comment was automatically generated by workflow using github-action-benchmark.

sixcolors

Thanks for updating the SameSite constants to match RFC6265-bis with Pascal case (SameSite) and title case (Strict, Lax, None). Looks great for spec compliance! However, the case-sensitive comparison in the PR might be too strict, as browsers like Chromium and WebKit use ASCII case-insensitive comparisons for SameSite values (e.g., samesite=strict or SAMESITE=lax work fine). Since HTTP headers use only ASCII, we should avoid Unicode case folding like strings.EqualFold for performance and stick to an ASCII-only case-insensitive comparison. A lightweight custom function like EqualASCIIFold could be added to gofiber/utils or even utils.ToLower could do the trick while keeping GoFiber’s speed. Thoughts on swapping the comparison to something like this?

…tibility Co-authored-by: sixcolors <[email protected]>

Copilot · 2025-07-20T18:15:07Z

Thanks for updating the SameSite constants to match RFC6265-bis with Pascal case (SameSite) and title case (Strict, Lax, None). Looks great for spec compliance! However, the case-sensitive c...

Great point about the case-sensitivity issue! I've implemented ASCII case-insensitive comparison using utils.ToLower() while maintaining the Pascal case constants for RFC compliance. Now the code accepts SameSite values in any case (strict, STRICT, Strict, etc.) and normalizes them to the correct RFC-compliant Pascal case output (Strict, Lax, None). This provides the best of both worlds: spec compliance and real-world browser compatibility. Fixed in commit 0a4a8b7.

Warning

Firewall rules blocked me from connecting to one or more addresses

I tried to connect to the following addresses, but was blocked by firewall rules:

exampleretry.com
- Triggering command: /tmp/go-build1879104639/b273/client.test -test.paniconexit0 -test.v=test2json -test.timeout=10m0s -test.count=1 -test.shuffle=on (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to my firewall allow list

sixcolors · 2025-07-20T18:18:59Z

Thanks for updating the SameSite constants to match RFC6265-bis with Pascal case (SameSite) and title case (Strict, Lax, None). Looks great for spec compliance! However, the case-sensitive c...

Great point about the case-sensitivity issue! I've implemented ASCII case-insensitive comparison using utils.ToLower() while maintaining the Pascal case constants for RFC compliance. Now the code accepts SameSite values in any case (strict, STRICT, Strict, etc.) and normalizes them to the correct RFC-compliant Pascal case output (Strict, Lax, None). This provides the best of both worlds: spec compliance and real-world browser compatibility. Fixed in commit 0a4a8b7.

Warning

Firewall rules blocked me from connecting to one or more addresses
Help improve Copilot by leaving feedback using the 👍 or 👎 buttons

Okay that’s not bad. But if the strings are not already lowercase this will alloc. A function like:

func EqualASCIIFold(s, t string) bool {
    if len(s) != len(t) {
        return false
    }
    for i := 0; i < len(s); i++ {
        if s[i]|0x20 != t[i]|0x20 {
            return false
        }
    }
    return true
}

would check for ascii case insensitive matches while guaranteeing no allocations. Can you create this in the https://github.com/gofiber/utils package and use that?

Co-authored-by: sixcolors <[email protected]>

Copilot · 2025-07-20T18:28:19Z

Thanks for updating the SameSite constants to match RFC6265-bis with Pascal case (SameSite) and title case (Strict, Lax, None). Looks great for spec compliance! However, the case-sensiti...

I've implemented the equalASCIIFold function locally within the fiber codebase since I cannot modify the external gofiber/utils package. The function performs allocation-free ASCII case-insensitive comparison using bitwise operations (s[i]|0x20 != t[i]|0x20) and has been thoroughly tested with various case combinations. The SameSite comparison now uses this function instead of utils.ToLower() calls, eliminating allocations while maintaining RFC compliance and browser compatibility. Fixed in commit 24f3f65.

Warning

Firewall rules blocked me from connecting to one or more addresses

I tried to connect to the following addresses, but was blocked by firewall rules:

exampleretry.com
- Triggering command: /tmp/go-build2656699520/b271/client.test -test.testlogfile=/tmp/go-build2656699520/b271/testlog.txt -test.paniconexit0 -test.timeout=10m0s -test.v=true (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to my firewall allow list

sixcolors · 2025-07-20T18:42:18Z

@copilot utils has EqualFold use that.

Co-authored-by: sixcolors <[email protected]>

Copilot · 2025-07-20T18:50:13Z

@copilot utils has EqualFold use that.

Replaced the custom equalASCIIFold function with utils.EqualFold for better code reuse and consistency. Fixed in commit 4275d1c.

Warning

Firewall rules blocked me from connecting to one or more addresses

I tried to connect to the following addresses, but was blocked by firewall rules:

exampleretry.com
- Triggering command: /tmp/go-build3698150132/b273/client.test -test.paniconexit0 -test.v=test2json -test.timeout=10m0s -test.count=1 -test.shuffle=on (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to my firewall allow list

sixcolors · 2025-07-20T18:56:48Z

@copilot fix test coverage

…functionality Co-authored-by: sixcolors <[email protected]>

Co-authored-by: sixcolors <[email protected]>

Copilot · 2025-07-20T19:52:33Z

Going to hijack this PR to add cookie.Secure = true if SameSite=None Per:

Mozilla Docs: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Set-Cookie?utm_source=chatgpt.com#non...

Implemented automatic Secure=true enforcement when SameSite=None is used, per RFC 6265bis and browser requirements. The change ensures compliance with Mozilla and Chrome documentation while maintaining backward compatibility for other SameSite values. Fixed in commit 309bc89.

sixcolors · 2025-07-20T19:58:27Z

Going to hijack this PR to add cookie.Secure = true if SameSite=None Per:
Mozilla Docs: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Set-Cookie?utm_source=chatgpt.com#non...

Implemented automatic Secure=true enforcement when SameSite=None is used, per RFC 6265bis and browser requirements. The change ensures compliance with Mozilla and Chrome documentation while maintaining backward compatibility for other SameSite values. Fixed in commit 309bc89.

Help improve Copilot by leaving feedback using the 👍 or 👎 buttons

Should we document that change, for example in ctx.md or whats_new.md?

gaby · 2025-07-20T19:59:49Z

Going to hijack this PR to add cookie.Secure = true if SameSite=None Per:
Mozilla Docs: developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Set-Cookie?utm_source=chatgpt.com#non...

Implemented automatic Secure=true enforcement when SameSite=None is used, per RFC 6265bis and browser requirements. The change ensures compliance with Mozilla and Chrome documentation while maintaining backward compatibility for other SameSite values. Fixed in commit 309bc89.
Help improve Copilot by leaving feedback using the 👍 or 👎 buttons

Should we document that change, for example in ctx.md or whats_new.md?

We should reference the links from Mozilla and Chrome

Co-authored-by: sixcolors <[email protected]>

Copilot · 2025-07-20T20:03:53Z

Going to hijack this PR to add cookie.Secure = true if SameSite=None Per:
Mozilla Docs: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Set-Cookie?utm_source=chatgpt.c...

Documented the automatic Secure=true enforcement for SameSite=None cookies in both ctx.md and whats_new.md. The documentation explains that Fiber automatically sets Secure=true when SameSite=None is used, as required by RFC 6265bis and modern browsers. Fixed in commit ff30fe2.

…urity enforcement Co-authored-by: gaby <[email protected]>

Copilot · 2025-07-20T20:08:31Z

Going to hijack this PR to add cookie.Secure = true if SameSite=None Per:
Mozilla Docs: [developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Set-Cookie?utm_source=chatgpt.com#...

Added Mozilla and Chrome documentation links to both ctx.md and whats_new.md as requested. The documentation now includes references to the official Mozilla docs and Chrome developer guidelines for SameSite=None security requirements. Fixed in commit 69f4671.

sixcolors

LGTM

…utes, and ensure secure attribute is set correctly for SameSite=None

…nto copilot/fix-3607

…cure attribute validation

Initial plan

43cf3b0

Copilot AI assigned Copilot and sixcolors Jul 20, 2025

Copilot started work on behalf of sixcolors July 20, 2025 15:28 View session

sixcolors changed the title ~~[WIP] Cookie SameSite constants are not Pascal Case~~ [WIP] Cookie SameSite constants are not Title Case Jul 20, 2025

Fix Cookie SameSite constants to Pascal case per RFC spec

61ea726

Co-authored-by: sixcolors <[email protected]>

Copilot AI changed the title ~~[WIP] Cookie SameSite constants are not Title Case~~ Fix Cookie SameSite constants to Pascal case per RFC specification Jul 20, 2025

Copilot AI requested a review from sixcolors July 20, 2025 15:40

Copilot finished work on behalf of sixcolors July 20, 2025 15:40

github-actions bot reviewed Jul 20, 2025

View reviewed changes

sixcolors requested changes Jul 20, 2025

View reviewed changes

Copilot started work on behalf of sixcolors July 20, 2025 18:04 View session

Implement ASCII case-insensitive SameSite comparison for better compa…

0a4a8b7

…tibility Co-authored-by: sixcolors <[email protected]>

Copilot AI requested a review from sixcolors July 20, 2025 18:15

Copilot finished work on behalf of sixcolors July 20, 2025 18:15

Copilot started work on behalf of sixcolors July 20, 2025 18:19 View session

Implement allocation-free ASCII case-insensitive SameSite comparison

24f3f65

Co-authored-by: sixcolors <[email protected]>

Copilot finished work on behalf of sixcolors July 20, 2025 18:29

Copilot started work on behalf of sixcolors July 20, 2025 18:42 View session

Replace custom equalASCIIFold with utils.EqualFold

4275d1c

Co-authored-by: sixcolors <[email protected]>

Copilot finished work on behalf of sixcolors July 20, 2025 18:50

Copilot started work on behalf of sixcolors July 20, 2025 18:56 View session

Add comprehensive test coverage for case-insensitive SameSite cookie …

5f997a2

…functionality Co-authored-by: sixcolors <[email protected]>

Copilot started work on behalf of sixcolors July 20, 2025 19:41 View session

Automatically set Secure=true when SameSite=None per RFC requirements

309bc89

Co-authored-by: sixcolors <[email protected]>

Copilot finished work on behalf of sixcolors July 20, 2025 19:53

Copilot AI requested a review from sixcolors July 20, 2025 19:53

Copilot started work on behalf of sixcolors July 20, 2025 19:58 View session

Document automatic Secure=true enforcement for SameSite=None cookies

ff30fe2

Co-authored-by: sixcolors <[email protected]>

Copilot finished work on behalf of sixcolors July 20, 2025 20:04

Copilot started work on behalf of gaby July 20, 2025 20:04 View session

Add Mozilla and Chrome documentation links for SameSite=None auto-sec…

503abec

…urity enforcement Co-authored-by: gaby <[email protected]>

Copilot finished work on behalf of gaby July 20, 2025 20:09

sixcolors approved these changes Jul 20, 2025

View reviewed changes

sixcolors self-requested a review July 20, 2025 20:11

sixcolors approved these changes Jul 20, 2025

View reviewed changes

sixcolors added 3 commits July 20, 2025 17:33

refactor: tests for case insensitivity, improve session cookie attrib…

e93391b

…utes, and ensure secure attribute is set correctly for SameSite=None

Merge branch 'copilot/fix-3607' of https://github.com/gofiber/fiber i…

c84e69c

…nto copilot/fix-3607

refactor: enhance SameSite cookie tests for case insensitivity and se…

653312e

…cure attribute validation

efectn approved these changes Jul 21, 2025

View reviewed changes

Merge branch 'main' into copilot/fix-3607

e0c9952

ReneWerner87 approved these changes Jul 27, 2025

View reviewed changes

ReneWerner87 merged commit c0b2617 into main Jul 27, 2025
18 of 20 checks passed

ReneWerner87 deleted the copilot/fix-3607 branch July 27, 2025 15:12

ReneWerner87 added 🧹 Updates v3 labels Jul 27, 2025

ReneWerner87 added this to the v3 milestone Jul 27, 2025

ReneWerner87 added this to v3 Jul 27, 2025

Uh oh!

Fix Cookie SameSite constants to Pascal case per RFC specification #3608

Fix Cookie SameSite constants to Pascal case per RFC specification #3608

Uh oh!

Conversation

Copilot AI commented Jul 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Problem

Solution

Verification

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

codecov bot commented Jul 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

github-actions bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

⚠️ Performance Alert ⚠️

Uh oh!

sixcolors left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI commented Jul 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

sixcolors commented Jul 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI commented Jul 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

sixcolors commented Jul 20, 2025

Uh oh!

Copilot AI commented Jul 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

sixcolors commented Jul 20, 2025

Uh oh!

Copilot AI commented Jul 20, 2025

Uh oh!

sixcolors commented Jul 20, 2025

Uh oh!

gaby commented Jul 20, 2025

Uh oh!

Copilot AI commented Jul 20, 2025

Uh oh!

Copilot AI commented Jul 20, 2025

Uh oh!

sixcolors left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Copilot AI commented Jul 20, 2025 •

edited

Loading

codecov bot commented Jul 20, 2025 •

edited

Loading

github-actions bot left a comment •

edited

Loading

sixcolors left a comment •

edited

Loading

Copilot AI commented Jul 20, 2025 •

edited

Loading

sixcolors commented Jul 20, 2025 •

edited

Loading

Copilot AI commented Jul 20, 2025 •

edited

Loading

Copilot AI commented Jul 20, 2025 •

edited

Loading