<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
We have Apache proxying to the IdP, so I put in the following config to decorate all cookies missing a SameSite attribute with SameSite=None if the user agent identifies itself as Chrom(e|ium) >= 80 and Firefox >= 79, to avoid breaking older browsers. I'm
not sure how correct this configuration is, but it seems to be working for us.</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
# Add SameSite attribute to cookies for Chrome / Chromium 80+ (matches Edge too)
<div> RewriteCond %{HTTP_USER_AGENT} "Chrom[^ \/]+\/(\d+)[\.\d]*"</div>
<div> RewriteCond %1 "-ge 80"</div>
<div> RewriteRule .* - [env=SAMESITE:1]</div>
<div><br>
</div>
<div> # Add SameSite attribute to cookies for Firefox 79+</div>
<div> RewriteCond %{HTTP_USER_AGENT} "Firefox\/(\d+)[\.\d]*"</div>
<div> RewriteCond %1 "-ge 79"</div>
<div> RewriteRule .* - [env=SAMESITE:1]</div>
<div><br>
</div>
<div> # Add SameSite=None when SAMESITE is true and cookie doesn't have SameSite already set (case-insensitive match).</div>
<div> # Need always and onsuccess directives because there are different header tables and neither is a superset of the other.</div>
<div> Header always edit Set-Cookie (?i)^(?!.*SameSite.*)(.+)$ "$1; SameSite=None" env=SAMESITE</div>
<span> Header onsuccess edit Set-Cookie (?i)^(?!.*SameSite.*)(.+)$ "$1; SameSite=None" env=SAMESITE</span><br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span><br>
</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span>Thanks,</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span>Ryan</span></div>
<div id="appendonsend"></div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Cantor, Scott <cantor.2@osu.edu><br>
<b>Sent:</b> Friday, January 21, 2022 07:16<br>
<b>To:</b> Shib Users <users@shibboleth.net><br>
<b>Subject:</b> Re: JSESSIONID issues, Stale Session. (SameSite issue?)</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt">
<div class="PlainText">On 1/21/22, 7:41 AM, "users on behalf of Duncan Brannen via users" <users-bounces@shibboleth.net on behalf of users@shibboleth.net> wrote:<br>
> Does anyone know under what circumstances the jsessionID value is replaced?<br>
<br>
Your container's/choice of session-timeout value.<br>
<br>
-- Scott<br>
<br>
<br>
-- <br>
For Consortium Member technical support, see <a href="https://shibboleth.atlassian.net/wiki/x/ZYEpPw">
https://shibboleth.atlassian.net/wiki/x/ZYEpPw</a><br>
To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net<br>
</div>
</span></font></div>
</body>
</html>