Use Lax Cookie for Preview Mode #11495

Timer · 2020-03-30T15:56:40Z

We currently use Strict SameSite cookies for Preview Mode. The reason for this pick was arbitrary, as we were erring to the least privileged option.

This pull request updates our Preview Mode cookie behavior to be Lax, which allows the following workflows:

Embedded previews within CMSes (using an <iframe>)
Redirects from Email or CMS authorization flow(s) will not require a page refresh to make "same origin"

We are comfortable with Lax as Chrome is moving to make this the default option for all cookies:
https://chromestatus.com/feature/5088147346030592

Using a Lax cookie is more secure than most browsers' current default: no same site requirement (Lax is more secure than browsers' current default: None).

Fixes #10881

ijjk · 2020-03-30T16:02:49Z

Stats from current PR

Default Server Mode (Decrease detected ✓)

General Overall decrease ✓

	zeit/next.js canary	Timer/next.js NEXT-154	Change
buildDuration	10.5s	10.4s	-148ms
nodeModulesSize	52.8 MB	52.8 MB	-24 B

Client Bundles (main, webpack, commons)

	zeit/next.js canary	Timer/next.js NEXT-154	Change
main-HASH.js gzip	6.24 kB	6.24 kB	✓
webpack-HASH.js gzip	746 B	746 B	✓
de003c3a9d30..c6c1.js gzip	10.1 kB	10.1 kB	✓
framework.HASH.js gzip	39.1 kB	39.1 kB	✓
Overall change	56.2 kB	56.2 kB	✓

Client Bundles (main, webpack, commons) Modern

	zeit/next.js canary	Timer/next.js NEXT-154	Change
main-HASH.module.js gzip	4.78 kB	4.78 kB	✓
webpack-HASH..dule.js gzip	746 B	746 B	✓
de003c3a9d30..dule.js gzip	6.71 kB	6.71 kB	✓
framework.HA..dule.js gzip	39.1 kB	39.1 kB	✓
Overall change	51.4 kB	51.4 kB	✓

Legacy Client Bundles (polyfills)

	zeit/next.js canary	Timer/next.js NEXT-154	Change
polyfills-HASH.js gzip	26.3 kB	26.3 kB	✓
Overall change	26.3 kB	26.3 kB	✓

Client Pages

	zeit/next.js canary	Timer/next.js NEXT-154	Change
_app.js gzip	1.24 kB	1.24 kB	✓
_error.js gzip	3.15 kB	3.15 kB	✓
hooks.js gzip	664 B	664 B	✓
index.js gzip	222 B	222 B	✓
link.js gzip	2.03 kB	2.03 kB	✓
routerDirect.js gzip	279 B	279 B	✓
withRouter.js gzip	278 B	278 B	✓
Overall change	7.86 kB	7.86 kB	✓

Client Pages Modern

	zeit/next.js canary	Timer/next.js NEXT-154	Change
_app.module.js gzip	594 B	594 B	✓
_error.module.js gzip	2.08 kB	2.08 kB	✓
hooks.module.js gzip	370 B	370 B	✓
index.module.js gzip	212 B	212 B	✓
link.module.js gzip	1.48 kB	1.48 kB	✓
routerDirect..dule.js gzip	271 B	271 B	✓
withRouter.m..dule.js gzip	270 B	270 B	✓
Overall change	5.28 kB	5.28 kB	✓

Client Build Manifests

	zeit/next.js canary	Timer/next.js NEXT-154	Change
_buildManifest.js gzip	61 B	61 B	✓
_buildManife..dule.js gzip	61 B	61 B	✓
Overall change	122 B	122 B	✓

Rendered Page Sizes

	zeit/next.js canary	Timer/next.js NEXT-154	Change
index.html gzip	916 B	916 B	✓
link.html gzip	925 B	925 B	✓
withRouter.html gzip	914 B	914 B	✓
Overall change	2.75 kB	2.75 kB	✓

Serverless Mode (Increase detected ⚠️)

General Overall decrease ✓

	zeit/next.js canary	Timer/next.js NEXT-154	Change
buildDuration	11.1s	11.3s	⚠️ +192ms
nodeModulesSize	52.8 MB	52.8 MB	-24 B

Client Bundles (main, webpack, commons)

	zeit/next.js canary	Timer/next.js NEXT-154	Change
main-HASH.js gzip	6.24 kB	6.24 kB	✓
webpack-HASH.js gzip	746 B	746 B	✓
de003c3a9d30..c6c1.js gzip	10.1 kB	10.1 kB	✓
framework.HASH.js gzip	39.1 kB	39.1 kB	✓
Overall change	56.2 kB	56.2 kB	✓

Client Bundles (main, webpack, commons) Modern

	zeit/next.js canary	Timer/next.js NEXT-154	Change
main-HASH.module.js gzip	4.78 kB	4.78 kB	✓
webpack-HASH..dule.js gzip	746 B	746 B	✓
de003c3a9d30..dule.js gzip	6.71 kB	6.71 kB	✓
framework.HA..dule.js gzip	39.1 kB	39.1 kB	✓
Overall change	51.4 kB	51.4 kB	✓

Legacy Client Bundles (polyfills)

	zeit/next.js canary	Timer/next.js NEXT-154	Change
polyfills-HASH.js gzip	26.3 kB	26.3 kB	✓
Overall change	26.3 kB	26.3 kB	✓

Client Pages

	zeit/next.js canary	Timer/next.js NEXT-154	Change
_app.js gzip	1.24 kB	1.24 kB	✓
_error.js gzip	3.15 kB	3.15 kB	✓
hooks.js gzip	664 B	664 B	✓
index.js gzip	222 B	222 B	✓
link.js gzip	2.03 kB	2.03 kB	✓
routerDirect.js gzip	279 B	279 B	✓
withRouter.js gzip	278 B	278 B	✓
Overall change	7.86 kB	7.86 kB	✓

Client Pages Modern

	zeit/next.js canary	Timer/next.js NEXT-154	Change
_app.module.js gzip	594 B	594 B	✓
_error.module.js gzip	2.08 kB	2.08 kB	✓
hooks.module.js gzip	370 B	370 B	✓
index.module.js gzip	212 B	212 B	✓
link.module.js gzip	1.48 kB	1.48 kB	✓
routerDirect..dule.js gzip	271 B	271 B	✓
withRouter.m..dule.js gzip	270 B	270 B	✓
Overall change	5.28 kB	5.28 kB	✓

Client Build Manifests

	zeit/next.js canary	Timer/next.js NEXT-154	Change
_buildManifest.js gzip	61 B	61 B	✓
_buildManife..dule.js gzip	61 B	61 B	✓
Overall change	122 B	122 B	✓

Serverless bundles Overall increase ⚠️

	zeit/next.js canary	Timer/next.js NEXT-154	Change
_error.js gzip	294 kB	294 kB	⚠️ +121 B
404.html gzip	1.32 kB	1.32 kB	✓
hooks.html gzip	957 B	957 B	✓
index.js gzip	294 kB	294 kB	-185 B
link.js gzip	301 kB	302 kB	⚠️ +884 B
routerDirect.js gzip	300 kB	300 kB	-640 B
withRouter.js gzip	300 kB	300 kB	⚠️ +34 B
Overall change	1.49 MB	1.49 MB	⚠️ +214 B

ijjk · 2020-03-30T16:06:17Z

Failing test suites

test/integration/prerender-preview/test/index.test.js

Prerender Preview Mode > Development Mode > should return cookies to be expired after dev server reboot
Prerender Preview Mode > Emulated Serverless Mode > should return cookies to be expired on reset request
Prerender Preview Mode > Server Mode > should return cookies to be expired on reset request
Prerender Preview Mode > Serverless Mode > should return cookies to be expired on reset request

Expand output

● Prerender Preview Mode › Development Mode › should return cookies to be expired after dev server reboot

expect(received).toBe(expected) // Object.is equality

Expected: 2
Received: 1

  271 |         .map(cookie.parse)
  272 | 
> 273 |       expect(cookies.length).toBe(2)
      |                              ^
  274 |     })
  275 | 
  276 |     afterAll(async () => {

  at Object.<anonymous> (integration/prerender-preview/test/index.test.js:273:30)

● Prerender Preview Mode › Server Mode › should return cookies to be expired on reset request

expect(received).toBe(expected) // Object.is equality

Expected: 2
Received: 1

  146 |       .map(cookie.parse)
  147 | 
> 148 |     expect(cookies.length).toBe(2)
      |                            ^
  149 |     expect(cookies[0]).toMatchObject({
  150 |       Path: '/',
  151 |       SameSite: 'Lax',

  at Object.<anonymous> (integration/prerender-preview/test/index.test.js:148:28)

● Prerender Preview Mode › Serverless Mode › should return cookies to be expired on reset request

expect(received).toBe(expected) // Object.is equality

Expected: 2
Received: 1

  146 |       .map(cookie.parse)
  147 | 
> 148 |     expect(cookies.length).toBe(2)
      |                            ^
  149 |     expect(cookies[0]).toMatchObject({
  150 |       Path: '/',
  151 |       SameSite: 'Lax',

  at Object.<anonymous> (integration/prerender-preview/test/index.test.js:148:28)

● Prerender Preview Mode › Emulated Serverless Mode › should return cookies to be expired on reset request

expect(received).toBe(expected) // Object.is equality

Expected: 2
Received: 1

  146 |       .map(cookie.parse)
  147 | 
> 148 |     expect(cookies.length).toBe(2)
      |                            ^
  149 |     expect(cookies[0]).toMatchObject({
  150 |       Path: '/',
  151 |       SameSite: 'Lax',

  at Object.<anonymous> (integration/prerender-preview/test/index.test.js:148:28)

test/integration/getserversideprops-preview/test/index.test.js

ServerSide Props Preview Mode > Development Mode > should return cookies to be expired after dev server reboot
ServerSide Props Preview Mode > Emulated Serverless Mode > should return cookies to be expired on reset request
ServerSide Props Preview Mode > Server Mode > should return cookies to be expired on reset request
ServerSide Props Preview Mode > Serverless Mode > should return cookies to be expired on reset request

Expand output

● ServerSide Props Preview Mode › Development Mode › should return cookies to be expired after dev server reboot

expect(received).toBe(expected) // Object.is equality

Expected: 2
Received: 1

  271 |         .map(cookie.parse)
  272 | 
> 273 |       expect(cookies.length).toBe(2)
      |                              ^
  274 |     })
  275 | 
  276 |     afterAll(async () => {

  at Object.<anonymous> (integration/getserversideprops-preview/test/index.test.js:273:30)

● ServerSide Props Preview Mode › Server Mode › should return cookies to be expired on reset request

expect(received).toBe(expected) // Object.is equality

Expected: 2
Received: 1

  140 |       .map(cookie.parse)
  141 | 
> 142 |     expect(cookies.length).toBe(2)
      |                            ^
  143 |     expect(cookies[0]).toMatchObject({
  144 |       Path: '/',
  145 |       SameSite: 'Lax',

  at Object.<anonymous> (integration/getserversideprops-preview/test/index.test.js:142:28)

● ServerSide Props Preview Mode › Serverless Mode › should return cookies to be expired on reset request

expect(received).toBe(expected) // Object.is equality

Expected: 2
Received: 1

  140 |       .map(cookie.parse)
  141 | 
> 142 |     expect(cookies.length).toBe(2)
      |                            ^
  143 |     expect(cookies[0]).toMatchObject({
  144 |       Path: '/',
  145 |       SameSite: 'Lax',

  at Object.<anonymous> (integration/getserversideprops-preview/test/index.test.js:142:28)

● ServerSide Props Preview Mode › Emulated Serverless Mode › should return cookies to be expired on reset request

expect(received).toBe(expected) // Object.is equality

Expected: 2
Received: 1

  140 |       .map(cookie.parse)
  141 | 
> 142 |     expect(cookies.length).toBe(2)
      |                            ^
  143 |     expect(cookies[0]).toMatchObject({
  144 |       Path: '/',
  145 |       SameSite: 'Lax',

  at Object.<anonymous> (integration/getserversideprops-preview/test/index.test.js:142:28)

ijjk · 2020-03-30T16:40:09Z

Stats from current PR

Default Server Mode (Decrease detected ✓)

General Overall decrease ✓

	zeit/next.js canary	Timer/next.js NEXT-154	Change
buildDuration	9.9s	10.2s	⚠️ +234ms
nodeModulesSize	52.8 MB	52.8 MB	-24 B

Client Bundles (main, webpack, commons)

	zeit/next.js canary	Timer/next.js NEXT-154	Change
main-HASH.js gzip	6.24 kB	6.24 kB	✓
webpack-HASH.js gzip	746 B	746 B	✓
de003c3a9d30..c6c1.js gzip	10.1 kB	10.1 kB	✓
framework.HASH.js gzip	39.1 kB	39.1 kB	✓
Overall change	56.2 kB	56.2 kB	✓

Client Bundles (main, webpack, commons) Modern

	zeit/next.js canary	Timer/next.js NEXT-154	Change
main-HASH.module.js gzip	4.78 kB	4.78 kB	✓
webpack-HASH..dule.js gzip	746 B	746 B	✓
de003c3a9d30..dule.js gzip	6.71 kB	6.71 kB	✓
framework.HA..dule.js gzip	39.1 kB	39.1 kB	✓
Overall change	51.4 kB	51.4 kB	✓

Legacy Client Bundles (polyfills)

	zeit/next.js canary	Timer/next.js NEXT-154	Change
polyfills-HASH.js gzip	26.3 kB	26.3 kB	✓
Overall change	26.3 kB	26.3 kB	✓

Client Pages

	zeit/next.js canary	Timer/next.js NEXT-154	Change
_app.js gzip	1.24 kB	1.24 kB	✓
_error.js gzip	3.15 kB	3.15 kB	✓
hooks.js gzip	664 B	664 B	✓
index.js gzip	222 B	222 B	✓
link.js gzip	2.03 kB	2.03 kB	✓
routerDirect.js gzip	279 B	279 B	✓
withRouter.js gzip	278 B	278 B	✓
Overall change	7.86 kB	7.86 kB	✓

Client Pages Modern

	zeit/next.js canary	Timer/next.js NEXT-154	Change
_app.module.js gzip	594 B	594 B	✓
_error.module.js gzip	2.08 kB	2.08 kB	✓
hooks.module.js gzip	370 B	370 B	✓
index.module.js gzip	212 B	212 B	✓
link.module.js gzip	1.48 kB	1.48 kB	✓
routerDirect..dule.js gzip	271 B	271 B	✓
withRouter.m..dule.js gzip	270 B	270 B	✓
Overall change	5.28 kB	5.28 kB	✓

Client Build Manifests

	zeit/next.js canary	Timer/next.js NEXT-154	Change
_buildManifest.js gzip	61 B	61 B	✓
_buildManife..dule.js gzip	61 B	61 B	✓
Overall change	122 B	122 B	✓

Rendered Page Sizes

	zeit/next.js canary	Timer/next.js NEXT-154	Change
index.html gzip	916 B	916 B	✓
link.html gzip	925 B	925 B	✓
withRouter.html gzip	914 B	914 B	✓
Overall change	2.75 kB	2.75 kB	✓

Serverless Mode (Increase detected ⚠️)

General Overall decrease ✓

	zeit/next.js canary	Timer/next.js NEXT-154	Change
buildDuration	10.7s	10.6s	-96ms
nodeModulesSize	52.8 MB	52.8 MB	-24 B

Client Bundles (main, webpack, commons)

	zeit/next.js canary	Timer/next.js NEXT-154	Change
main-HASH.js gzip	6.24 kB	6.24 kB	✓
webpack-HASH.js gzip	746 B	746 B	✓
de003c3a9d30..c6c1.js gzip	10.1 kB	10.1 kB	✓
framework.HASH.js gzip	39.1 kB	39.1 kB	✓
Overall change	56.2 kB	56.2 kB	✓

Client Bundles (main, webpack, commons) Modern

	zeit/next.js canary	Timer/next.js NEXT-154	Change
main-HASH.module.js gzip	4.78 kB	4.78 kB	✓
webpack-HASH..dule.js gzip	746 B	746 B	✓
de003c3a9d30..dule.js gzip	6.71 kB	6.71 kB	✓
framework.HA..dule.js gzip	39.1 kB	39.1 kB	✓
Overall change	51.4 kB	51.4 kB	✓

Legacy Client Bundles (polyfills)

	zeit/next.js canary	Timer/next.js NEXT-154	Change
polyfills-HASH.js gzip	26.3 kB	26.3 kB	✓
Overall change	26.3 kB	26.3 kB	✓

Client Pages

	zeit/next.js canary	Timer/next.js NEXT-154	Change
_app.js gzip	1.24 kB	1.24 kB	✓
_error.js gzip	3.15 kB	3.15 kB	✓
hooks.js gzip	664 B	664 B	✓
index.js gzip	222 B	222 B	✓
link.js gzip	2.03 kB	2.03 kB	✓
routerDirect.js gzip	279 B	279 B	✓
withRouter.js gzip	278 B	278 B	✓
Overall change	7.86 kB	7.86 kB	✓

Client Pages Modern

	zeit/next.js canary	Timer/next.js NEXT-154	Change
_app.module.js gzip	594 B	594 B	✓
_error.module.js gzip	2.08 kB	2.08 kB	✓
hooks.module.js gzip	370 B	370 B	✓
index.module.js gzip	212 B	212 B	✓
link.module.js gzip	1.48 kB	1.48 kB	✓
routerDirect..dule.js gzip	271 B	271 B	✓
withRouter.m..dule.js gzip	270 B	270 B	✓
Overall change	5.28 kB	5.28 kB	✓

Client Build Manifests

	zeit/next.js canary	Timer/next.js NEXT-154	Change
_buildManifest.js gzip	61 B	61 B	✓
_buildManife..dule.js gzip	61 B	61 B	✓
Overall change	122 B	122 B	✓

Serverless bundles Overall increase ⚠️

	zeit/next.js canary	Timer/next.js NEXT-154	Change
_error.js gzip	293 kB	294 kB	⚠️ +714 B
404.html gzip	1.32 kB	1.32 kB	✓
hooks.html gzip	957 B	957 B	✓
index.js gzip	294 kB	294 kB	⚠️ +254 B
link.js gzip	301 kB	302 kB	⚠️ +617 B
routerDirect.js gzip	300 kB	300 kB	-103 B
withRouter.js gzip	300 kB	300 kB	⚠️ +641 B
Overall change	1.49 MB	1.49 MB	⚠️ +2.12 kB

Use Lax Cookie for Preview Mode

20be0be

Timer added Type: Enhancement labels Mar 30, 2020

Timer added this to the 9.3.4 milestone Mar 30, 2020

Timer requested review from ijjk, lfades and timneutkens as code owners March 30, 2020 15:56

Fix tests

97c4edb

timneutkens approved these changes Mar 30, 2020

View reviewed changes

ijjk approved these changes Mar 30, 2020

View reviewed changes

Timer added 3 commits March 30, 2020 12:44

Merge branch 'canary' into NEXT-154

200aa7b

Merge branch 'canary' into NEXT-154

1381289

Merge branch 'canary' into NEXT-154

d6cee89

Timer merged commit c2c4241 into vercel:canary Mar 30, 2020

Timer deleted the NEXT-154 branch March 30, 2020 16:47

This was referenced Mar 31, 2020

Preview cookies not passed for sequenced redirects #11304

Closed

Preview does not work as intended with Contentful (localhost) #11228

Closed

Enable preview mode during development in an iframe #11356

Closed

snyk-bot mentioned this pull request Apr 13, 2020

[Snyk] Upgrade next from 9.3.2 to 9.3.4 yowainwright/Advanced-React#46

Merged

This was referenced Apr 24, 2020

[Snyk] Upgrade next from 9.3.3 to 9.3.4 willemliu/static-next#2

Closed

[Snyk] Upgrade next from 9.3.3 to 9.3.4 zagrajmy/frontend#163

Open

vercel locked as resolved and limited conversation to collaborators Jan 31, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Use Lax Cookie for Preview Mode #11495

Use Lax Cookie for Preview Mode #11495

Timer commented Mar 30, 2020 •

edited

Loading

ijjk commented Mar 30, 2020

ijjk commented Mar 30, 2020 •

edited

Loading

ijjk commented Mar 30, 2020

Use Lax Cookie for Preview Mode #11495

Use Lax Cookie for Preview Mode #11495

Conversation

Timer commented Mar 30, 2020 • edited Loading

ijjk commented Mar 30, 2020

Stats from current PR

ijjk commented Mar 30, 2020 • edited Loading

Failing test suites

ijjk commented Mar 30, 2020

Stats from current PR

Timer commented Mar 30, 2020 •

edited

Loading

ijjk commented Mar 30, 2020 •

edited

Loading