Q:

Current status of SameSite cookie

Recently I got to know about SameSite cookie attribute which is used to mitigate the CSRF attacks. AFAIK SameSite attribute for cookies is implemented in Chrome and some other browsers. Since I'm Using Tomcat server to deploy my web apps, I have raised a discussion with Tomcat dev to see whether they have plans to support this in an upcoming release. They said that if the spec work had not stopped and/or the protection it offered was more complete, then they can consider supporting SameSite Cookie. Here I want to clarify below-mentioned questions.

Since the draft is expired [1], what is the Current status of SameSite cookie?
Will it be a standard solution?

[1] [https://www.ietf.org/archive/id/draft-ietf-httpbis-rfc6265bis-02.txt]

A:

SameSite cookies are here to stay.
They were available for a long time in Chrome (since v51) and more recently got implemented in Firefox. 
Making cookies samesite protect against a whole range of CSRF vulnerabilities. It protects against BREACH, a compression side channel attack that can steal a cookie by forging a lot of authenticated requests. It protects against some client-side Spectre attacks, where the response to a cross-origin request is read using speculative execution vulnerabilties.
The spec is still being worked on. For example, how strict samesite cookies should behave in redirects is not entirely clear.
I would currently advise everybody to set samesite=Lax on all cookies. It offers a reasonable security advantage without breaking things or being too much work. Using samesite=Strict cookies gives more security, but may break some functions on your site.
Server software needs to give the option to set the samesite attribute to either Lax or Strict. That part of the spec is very stable and it would not be premature to offer that. For example, PHP is planning to add samesite to their setcookie function.
Also, I would expect that you could use samesite cookies even if Tomcat doesn't implement it, if you create your own Set-Cookie headers.
Update: Chrome is planning to make all cookies SameSite=Lax by default, which you can disable by setting SameSite=None.

