4 ms·
Ah, the dates of the comments at the bottom helped explain the lack of modern day issues we now hit - 3p cookie depreciation and the Chrome Samesite change. Bot
by hirsin 6y ago
Ah, the dates of the comments at the bottom helped explain the lack of modern day issues we now hit - 3p cookie depreciation and the Chrome Samesite change. Both of these break logout, but certainly weren't a concern in 2008.
- mooreds 6y agoIt was last updated in 2017 per the date at the top, but yes, it's an older article. This post indicates that 3p cookie issues only affect SSO providers without a hostname that lives within the primary websites domains: https://blogs.akamai.com/2020/01/cookies-single-sign-on-and-you.html https://blogs.akamai.com/2020/01/cookies-single-sign-on-and-... (so SaaS offerings without domain masking). Is that your understanding? Here's an interesting post on the samesite implications: https://www.troyhunt.com/promiscuous-cookies-and-their-impending-death-via-the-samesite-policy/ https://www.troyhunt.com/promiscuous-cookies-and-their-impen...
- hirsin 6y agoYup, that's precisely it. We documented the login breaks from Samesite and 3p cookies, but logout was both not particularly a concern for folks (I've gotten about three inquiries in two years), and pointless to document tombstoning patterns for Samesite since ITP would break those anyway. https://docs.microsoft.com/en-us/azure/active-directory/develop/howto-handle-samesite-cookie-changes-chrome-browser?tabs=dotnet https://docs.microsoft.com/en-us/azure/active-directory/deve...
- alfu 6y agoIs the conclusion to just use use SameSite=None? I did some research while back and found that shibboleth supports local storage for sessions [0], unfortunately the IdP+SP I'm using do not support such a thing. [0] https://wiki.shibboleth.net/confluence/display/DEV/IdP+SameSite+Testing https://wiki.shibboleth.net/confluence/display/DEV/IdP+SameS...