<div dir="ltr"><div class="gmail_quote"><div dir="ltr" class="gmail_attr">pi 24. 5. 2024 o 17:38 Cantor, Scott <<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>> napísal(a):<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">I doubt this is about local storage, it's likely a SameSite issue with the cookies in either case.<br></blockquote><div><br></div><div><div>I tried to look for differences and they are:</div><div><br></div><div>working SAML Logout:</div><div><br></div><div><span>Sec-Fetch-Dest</span><span>: </span>document
<span><br></span></div><div><span>Sec-Fetch-Mode</span><span>: </span>navigate <br></div><div><span>Sec-Fetch-Site</span><span>: </span>cross-site</div><div><span class="gmail-hljs-attribute">Cookie</span><span class="gmail-hljs-punctuation">: </span>JSESSIONID=node0vb27lyy5bv7md6xvjslgvj0r143.node0; </div><div>shib_idp_session=c43e08b0b26341fd22b30068aec9d522a66d533665b7282b694c015bb2bc8bc5</div><div><br></div><div>Office 365 SAML Logout:</div><div><br></div><div><span>Sec-Fetch-Dest</span><span>: </span>iframe
<span><br></span></div><div><span>Sec-Fetch-Mode</span><span>: </span>navigate
<span><br></span></div><div><span>Sec-Fetch-Site</span><span>: </span>cross-site</div><div><span class="gmail-hljs-attribute">Cookie</span><span class="gmail-hljs-punctuation">: </span>JSESSIONID=node0vb27lyy5bv7md6xvjslgvj0r143.node0  (only on Firefox but missing on Chrome, Safari etc.)</div><div><br></div><div>shib_idp_session cookie is missing on all browsers - could this explain the inability to find a session in client's storage?<br></div><div><br></div><div>IdP doesn't seem to use any SameSite= parameter for Cookies:</div><div><br></div><div><span>Set-Cookie</span><span>: </span>JSESSIONID=node01i3tafqghf06d1dfqb4on1kq9c145.node0; Path=/idp; Secure; HttpOnly</div><div><span>Set-Cookie</span><span>: </span>shib_idp_session=c43e08b0b26341fd22b30068aec9d522a66d533665b7282b694c015bb2bc8bc5; Path=/idp; Secure; HttpOnly</div><div><br></div><div>Should I add it somewhere (Shibbolet, Jetty) or make some other changes to get it working?</div><div><br></div><div>Thanks, Petr<br></div><div><br><br></div> </div></div></div>