Looping issue where no cookies are being sent in the response (Azure ad, shibboleth sp)

[Christopher Bongaarts]

On 7/29/2022 11:35 AM, Cantor, Scott via users wrote:
> On 7/29/22, 11:37 AM, "users on behalf of Robert Bradley" <users-bounces at shibboleth.net on behalf of robert.bradley at it.ox.ac.uk> wrote:
>
>>     I wouldn't rule out issues with not setting SameSite=None on cookies
>>     either, based on past experience.
> The SP's session cookie doesn't cross sites in that manner, so it wasn't ever impacted by SameSite in that way (and is still not set to None by default in fact).

We recently fixed an SP that was having looping problems because we were 
setting SameSite=None but had neglected to add "secure" as a cookieProp 
(if you omit the "secure" then Chrome ignores the cookie setting 
altogether).

-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%