3 ms·

Can you give some pointers or what to search for regarding OIDC and 3rd party cookies? I've implemented both OIDC SSO and SLO between a lot of varying services

by MzHN 2y ago

Can you give some pointers or what to search for regarding OIDC and 3rd party cookies? I've implemented both OIDC SSO and SLO between a lot of varying services and identity providers and have never needed 3rd party cookies so I'm curious. Only place I've seen it are some really old SAML implementations and even those could be reworked to not use 3rd party cookies.

jonkoops 2y ago
This is specific to when you run a deployment where a user is authenticated cross domain with a authentication server. If a user wants to sign in to foo.com through auth.com it is not possible for foo.com to know if the user has a session, so it needs to redirect the user to auth.com to understand if the user has a session. Previously this could be handled by embedding an iframe into foo.com with auth.com that can read the session cookie, this is no longer possible due to cookie protection. Also if a user is signed into auth.com and foo.com, and then signs out of auth.com it is not possible to detect the user has signed out, as foo.com cannot access cookies set on auth.com.