__host-jsessionid changes inappropriately

[Nabeelah Azam, Fnu]

Scott,

We’re on version 5.1.3. However, I was missing the conditions set up as true for the same site setting. Post configuring that, I do see none under the same site settings. 

Hopefully, this was the only configuration that we were missing, and it fixes our issue.

Thank you for your help,
Nabeelah Azam

-----Original Message-----
From: Cantor, Scott <cantor.2 at osu.edu> 
Sent: Thursday, August 15, 2024 5:18 PM
To: Shib Users <users at shibboleth.net>
Cc: Nabeelah Azam, Fnu <nabeelah.azam at shsu.edu>; Ainsworth, Christopher <christopher.ainsworth at shsu.edu>; Taylor, Michael <michael.taylor at shsu.edu>
Subject: Re: __host-jsessionid changes inappropriately

CAUTION:The sender of this email is not from SHSU.
Any links or attachments may be dangerous. To report this email as suspicious, forward it to abuse at shsu.edu.

Make sure you're on 5.1.3, but you'd need to trace it and determine if SameSite=none is actually being set or not and what cookie(s) the browser actually accepts. There are plugins all over that help with that.

If you're not on 5.1.3, don't waste your time until that's addressed.

> In our idp-properties configuration we have the following properties 
> configured idp.cookie.sameSite = None

That doesn't set SameSite, it tells it what to set it to if the sameSiteCondition property next to it is actually set to something that evaluates to true.

-- Scott