{"push_id":2474544968,"size":2,"distinct_size":2,"ref":"refs/heads/master","head":"ebe8f8ea69c02d83e5dceb91fdae0e787845c7ba","before":"596173b2958803d4115c7e9c937d023afd777a3c","commits":[{"sha":"c303325cd14b3fbbda85b22f2bdee622d922c5be","author":{"name":"Francois Marier","email":"5187da0b934cc25eb2201a3ec9206c24b13cb23b@mozilla.com"},"message":"Clarify handling of invalid SameSite values (fixes #389)\n\nThere is currently a discrepancy in the spec regarding invalid values\nin the SameSite cookie attribute.\n\nFor example, this cookie:\n\n  Set-Cookie: foo=bar; SameSite=bogus\n\nis expected to be dropped entirely according to the \"Server Requirements\"\nunder Section 4.1.2.7:\n\n  If the \"SameSite\" attribute's value is neither of these [ \"Lax\",\n  \"Strict\" ], the cookie will be ignored.\n\nwhereas under Section 5.3.7 of \"User Agent Requirements\", the cookie\nis to be kept but the attribute is ignored:\n\n  If cookie-av's attribute-value is not a case-insensitive match for\n  \"Strict\" or \"Lax\", ignore the \"cookie-av\".\n\nAdditionally, the end of Section 4.1.2 also matches the behavior\ndescribed in Section 5.3.7:\n\n  User agents ignore unrecognized cookie attributes (but not the entire\n  cookie).\n\nFrom a forward-compatibility point of view, the behavior described in\nsection 5.3.7 is the ideal one since it allows for future expansion\nof this feature such as:\n\n  Set-Cookie: foo=bar; SameSite=medium","distinct":true,"url":"https://api.github.com/repos/httpwg/http-extensions/commits/c303325cd14b3fbbda85b22f2bdee622d922c5be"},{"sha":"ebe8f8ea69c02d83e5dceb91fdae0e787845c7ba","author":{"name":"Mike West","email":"a17fed27eaa842282862ff7c1b9c8395a26ac320@mikewest.org"},"message":"Merge pull request #574 from fmarier/samesite-bogus-values-389\n\nClarify handling of invalid SameSite values (fixes #389)","distinct":true,"url":"https://api.github.com/repos/httpwg/http-extensions/commits/ebe8f8ea69c02d83e5dceb91fdae0e787845c7ba"}]}
{"actor":{"display_login":"mikewest"}}