IIS Module Intermittently Failing to Query Daemon over a TCPListener for Session Information

[Cantor, Scott]

On 7/20/21, 12:01 PM, "users on behalf of Nate Klingenstein" <users-bounces at shibboleth.net on behalf of ndk at signet.id> wrote:

> For the record, we finally managed to roll this change out in a production environment this morning, and it
> looks like sameSiteSession=None and "secure" was the fix.  We couldn't use the https shorthand because we
> have to handle vanity domains, but so far, so good.  No looping.

sameSiteSession only matters if you want to POST forms from a third party site back to the SP application and maintain the session. It applies when application logic crosses sites and forms are involved. Otherwise, you're literally opening up the application to CSRF by enabling that.

We had an application that was doing POSTs back to Peoplesoft for ordering supplies, for example, that's when it matters.

-- Scott