Play Framework 2.6/2.7 版将 PLAY_SESSION cookie 设置为 SameSite=None； 安全的

Question

There's many posts confirming that play supports the SameSite=None; Secure SameSite=None; Secure requirement. However when configuring the session through config like this:

    ...
    play.http.session.httpOnly=true
    play.http.session.sameSite="None"
    play.http.session.secure=true
    ...

Chrome tells me that None is not getting set. See below:

To validate I'm on the right back-ported version(2.6.24) I implemented a filter to set other cookies I have control over and when I construct a cookie manually like this:

   Cookie(
      key,
      value,
      secure = true,
      sameSite = Some(Cookie.SameSite.None)
    )

Chrome will show that SameSite=None; Secure SameSite=None; Secure does get set on those cookies. Which makes me think there's something with the config implementation that is not understanding None the play docs indicate you can only pass Strict or Lax as well but I was hoping that was just a documentation error.

EDIT: Confirmed cbley answer 2.6.25 works see below screen shot

Answer 1

这在 Play 版本 2.6.25 和 2.7.5 中已修复。