Stale session errors after upgrading to 5.2.2

[Scott Cantor]

> On May 20, 2026, at 2:46 PM, Wessel, Keith via users <users at shibboleth.net> wrote:
> 
> Thanks, Scott. This was screaming samesite behavior to me. Don't know how we missed that in the release notes.
> 
> So, with this change, do I still even need the samesite settings in idp.properties?

If you want SSO you do. There are many cookies and many different cases, and the only thing web.xml controls is the container's session. Ours are still separately controlled. It was not deliberately a goal to split the control points, that's just a consequence of how Java webapps work.

> Also, there's a samesite property documented in the release notes for 5.2.0that isn't documented in the IdP 5 samesite docs: idp.cookie.sameSite.autoDisableFilter. What's the purpose of this?

It automatically disables the legacy filter we used to hack in support for SameSite before, it was just a safety valve in case the old filter had to be enabled for some reason, I'll add it to the docs when I have a chance. It's safely ignorable, enough people have been using the new version to verify it's working like it should.

-- Scott