title: How to set SameSite and Secure attribute to JSESSIONID cookie
body: <p>I have a Spring Boot Web Application (Spring boot version 2.0.3.RELEASE) and running in an Apache Tomcat 8.5.5 server.</p>
  <p>With the recent security policy which has imposed by Google Chrome (Rolled out since 80.0), it is requested to apply the new <code>SameSite</code> attribute to make the Cross-site cookie access in a more secure way instead of the CSRF. As I have done nothing related that and Chrome has set default value <code>SameSite=Lax</code> for the first-party cookies, one of my third-party service integration is failing due to the reason that chrome is restricting access of cross-site cookies when <code>SameSite=Lax</code> and if the third party response is coming from a <code>POST</code> request (O<em>nce the procedure completes third-party service redirect to our site with a <code>POST</code> request</em>). in there Tomcat unable to find the session so it appends a new <code>JSESSIONID</code> (with a new session and the previous session was killed) at the end of the URL. So Spring rejects the URL as it contains a semicolon which was introduced by the new <code>JSESSIONID</code> append.</p>
  <p>So I need to change the <code>JSESSIONID</code> cookie attributes(<code>SameSite=None; Secure</code>) and tried it in several ways including WebFilters.I have seen the same question and answers in Stackoverflow and tried most of them but ended up in nowhere.</p>
  <p>can someone come up with a solution to change those headers in Spring Boot, please?</p>