Shib IdP: Box app failing on iOS 13

[Cantor, Scott]

> We're getting reports of people not being able to log into the Box application
> from iOS/iPadOS 13.

I just did.

> We're running IdP 3.4.3 on tomcat 8. Any ideas? (SameSite maybe?)

Safari doesn't interpret the lack of SameSite as anything, and I would be surprised if anything Box is running on iOS did, but only they could answer that. So unless you're mislabeling the cookies yourself with code you built and making them "strict", it can't be SameSite.

The Apple bug in iOS12 that's now fixed applies to "SameSite: none", and does not, supposedly, afflict iOS 13 either.

-- Scott