470 questions
0
votes
1
answer
169
views
Prevent session collision / override from cross-site requests when using SameSite=lax
I am using session ids to enable various features for logged and unlogged users on my website. This include matching the csrf token to the session id.
I store the session id as a SameSite=lax cookie.
...
- 91
1
vote
1
answer
155
views
superset iframe embedding working in firefox
I am embedding Apache Superset’s dashboard builder inside my MERN application using an iframe.
This setup works perfectly in Firefox, but in Google Chrome the iframe fails to load. Instead, I see ...
- 11
0
votes
0
answers
107
views
ASP.NET cookies with requireSSL=false stopped working in Edge 139 — are SameSite=None cookies now blocked unless Secure
We are experiencing a sudden failure in SAML authentication (500 Internal Server Error) in our ASP.NET web application that uses Microsoft Entra ID (SSO).
Environment details:
ASP.NET app running on ...
- 107
0
votes
1
answer
101
views
Using different samesite cookie value in different pages
A website using payment gateway requires Samesite as None to continue session for users returning from payment gateway to website. In other pages of website Samesite should be Lax or strict to ...
- 13
0
votes
0
answers
161
views
Set-Cookie header silently ignored by browser, doesn't save cookie
I've seen many variations of this question here, but as far as I can tell, my setup should be working.
I'm working on a Next.js application that's sending a PUT request to our backend, which is ...
0
votes
1
answer
290
views
Browser behaviour when SameSite conflicts with Access-Control-Allow-Origin and Access-Control-Allow-Credentials
Suppose on mywebsite.com, I have a cookie with SameSite=Strict, so that it is not allowed to go up via third party requests to mywebsite.com.
Suppose also on mywebsite.com I am setting Access-Control-...
- 6,689
0
votes
0
answers
63
views
Issue with cookie's SameSite attribute in Angular and .NET
I'm hosting an Angular app on http://app.localhost URL.
Where am checking, setting and modifying an authentication related cookie on initial page load, login and logout API calls.
Cookie's SameSite ...
- 125
1
vote
1
answer
1k
views
How to bypass SameSite cookie restriction in Microsoft Edge during local development (HTTP) so browser can accept cookie send from backend
I'm working on a local development project where I have an Angular frontend running on port 4200 and an Express backend running on port 3000, both served over HTTP. I need to use cookies with SameSite=...
- 109
0
votes
0
answers
382
views
Debugging cookie issues in Next.js: SameSite=None not applying on HTTPS localhost
Title: Cookie not being set in localhost environment with Next.js app
I'm trying to test cookies in a localhost environment for a web app built with Next.js. I've sent a cookie from the server with ...
- 35
2
votes
0
answers
688
views
Google Recaptcha v3 without third party cookies
I'm using the following Flutter package
https://pub.dev/packages/g_recaptcha_v3
When running my app on web I see the following warning in the warning in the console
_GRECAPTCHA www.google.com/...
- 3,591
1
vote
1
answer
450
views
Why is Spring Security setting CSRF cookie with SameSite=None attribute?
I have a Springboot application with Spring Security 6 and a single page application for frontend (Vue). I configured anti-CSRF using the exact same config as the one described in the documentation. ...
- 2,055
0
votes
1
answer
1k
views
How Samesite cookie settings works with iframes
I have to embed a page with iframe to a different domain page.
This iframe is loaded with a jwt token that authenticates the user in domain B.
This response, creates a session cookie and reloads the ...
- 9,635
0
votes
1
answer
252
views
How to update/set SameSite value from “Strict” to "Lax" in chrome, edge, safari browser?
How to update/set SameSite value from “Strict” to "Lax" in chrome, edge, safari browser?
The below answer is outdated
How to disable same site policy in Chrome?
No option available as ...
- 1
0
votes
0
answers
210
views
Samesite strict and redirects within the same domain
Our policy was set to samesite = strict and most everything was working.
However one SSO (openId) login was not playing nicely.
User starts at ourdomain.com/login, hits the SSO button and gets ...
- 83
1
vote
0
answers
28
views
Set-Cookie is being set on redirection in ASP.NET MVC on .NET 4.7.2 . Why?
I am setting SameSite in Startup.Auth.cs like this:
CookiePath = "/; SameSite=Lax",
But for Login action, on redirection; the Set-Cookie value is being automatically set by the framework ...
- 11