Bit of a SameSite update

[Ryan Larscheidt]

Agreed that this is odd.  I have been able to reliably reproduce it with the following steps:

  1.  Trigger SSO with HTTP-POST from an SP at an "external" domain from the IdP
  2.  "Reload" the SP session several times (I've been using the /Shibboleth.sso/Login endpoint), SSO works
  3.  Wait 2 minutes
  4.  Reload the SP session again, SSO works
  5.  Reload the SP session again, SSO fails and prompts for credentials
  6.  Clear IdP's JSESSIONID cookie
  7.  Go back to SP and reload the session again, SSO works
  8.  Reload the SP session again, SSO fails and prompts for credentials

Continuing to clear the JSESSIONID cookie will allow for one successful SSO via HTTP-POST before failing again.  If I don't remove the JESSIONID cookie then I keep getting the login page.

This feels like Chrome's 2-minute "Lax + POST" window, let me know if there's more info I should provide.

Thanks,
Ryan

________________________________
From: users <users-bounces at shibboleth.net> on behalf of Cantor, Scott <cantor.2 at osu.edu>
Sent: Friday, August 14, 2020 11:32
To: Shib Users <users at shibboleth.net>
Subject: Re: Bit of a SameSite update

On 8/14/20, 12:19 PM, "users on behalf of Ryan Larscheidt" <users-bounces at shibboleth.net on behalf of larscheidt at wisc.edu> wrote:

>    I just want to verify that the "do nothing" option is still viable, perhaps I missed a setting?

I think it is for the most part, but the use of frames was creating some unusual behavior because that prevented the local storage load (it was a hidden iframe and so it wouldn't work unless I could keep JSESSIONID stable).

I haven't seen any issues in normal cases and if you are, something else is going on.

-- Scott


--
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20200814/8fa07b1e/attachment.htm>