__host-jsessionid changes inappropriately

[Nabeelah Azam, Fnu]

Ah, that makes much sense. Thank you, Scott! 

Nabeelah Azam

IT Strategic Alignment |View the IT at Sam Roadmap

-----Original Message-----
From: Cantor, Scott <cantor.2 at osu.edu> 
Sent: Friday, August 16, 2024 8:37 AM
To: Nabeelah Azam, Fnu <nabeelah.azam at shsu.edu>; Shib Users <users at shibboleth.net>
Cc: Ainsworth, Christopher <christopher.ainsworth at shsu.edu>; Taylor, Michael <michael.taylor at shsu.edu>
Subject: Re: __host-jsessionid changes inappropriately

CAUTION:The sender of this email is not from SHSU.
Any links or attachments may be dangerous. To report this email as suspicious, forward it to abuse at shsu.edu.

> Oh yes, likely for them to do that. Out of curiosity, is there a 
> particular reason as to why those settings are disabled by default?
> Is it only because browsers are subject to change at any time and 
> having them enabled may cause issues?

At the time, there were extant, though out of date, versions of Safari that were broken if you set SameSite to none, and they behaved worse than if it wasn't set at all. Some Android too, though much older (but also even less controllable given how phones are updated).

I suspect for 6.0 we will flip the default.

Whether there are existing clients likely to have problems is impossible to say, that's why the option is a condition and not a boolean.

-- Scott