Workaround of SameSite default change for Shibboleth SP _shibstate_ ?

[Pishioneri, Phil]

On 2020/1/31 5:16 AM, Takeshi NISHIMURA wrote:
> I found it is difficult to conditionally add SameSite=None to _shibstate_ cookie.
>
> We use Shibboleth SP and Apache httpd on CentOS 7.
> By the following configuration I succeeded in adding SameSite flag to e.g. JSESSIONID, but it resulted in no effect for Shibboleth SP's cookies.
>
>> Header edit Set-Cookie ^(.*)$ $1;SameSite=None


In my testing (on an IdP with apache httpd in front of tomcat), I had
two forms of that directive active:

Header always    edit Set-Cookie (.*) "$1; SameSite=none"
Header onsuccess edit Set-Cookie (.*) "$1; SameSite=none"

The SameSite web page I had found recommended the "always" version, but
I found I had to use the "onsuccess" one, and decided to keep both
active (on a test system). (And yes, I realize that putting that on an
IdP most likely won't help anything.)

-Phil