Skip to content

Commit d171397

Browse files
henrymbuguakiariehenrymbuguakiarie
committed
[msid][content-health] howto-handle-samesite-cookie-changes-chrome-browser (ADO-62855)
1 parent f472eb3 commit d171397

File tree

1 file changed

+18
-17
lines changed

1 file changed

+18
-17
lines changed

‎articles/active-directory/develop/howto-handle-samesite-cookie-changes-chrome-browser.md

Lines changed: 18 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -9,11 +9,12 @@ ms.service: active-directory
99
ms.subservice: develop
1010
ms.workload: identity
1111
ms.topic: conceptual
12-
ms.date: 01/27/2020
12+
ms.date: 02/07/2023
1313
ms.author: henrymbugua
1414
ms.reviewer: kkrishna, jmprieur
1515
ms.custom: aaddev
1616
---
17+
1718
# Handle SameSite cookie changes in Chrome browser
1819

1920
## What is SameSite?
@@ -29,7 +30,7 @@ By default, the `SameSite` value is NOT set in browsers and that's why there are
2930

3031
Recent [updates to the standards on SameSite](https://tools.ietf.org/html/draft-west-cookie-incrementalism-00) propose protecting apps by making the default behavior of `SameSite` when no value is set to Lax. This mitigation means cookies will be restricted on HTTP requests except GET made from other sites. Additionally, a value of **None** is introduced to remove restrictions on cookies being sent. These updates will soon be released in an upcoming version of the Chrome browser.
3132

32-
When web apps authenticate with the Microsoft Identity platform using the response mode "form_post", the login server responds to the application using an HTTP POST to send the tokens or auth code. Because this request is a cross-domain request (from `login.microsoftonline.com` to your domain - for instance `https://contoso.com/auth`), cookies that were set by your app now fall under the new rules in Chrome. The cookies that need to be used in cross-site scenarios are cookies that hold the *state* and *nonce* values, that are also sent in the login request. There are other cookies dropped by Azure AD to hold the session.
33+
When web apps authenticate with the Microsoft identity platform using the response mode "form_post", the login server responds to the application using an HTTP POST to send the tokens or auth code. Because this request is a cross-domain request (from `login.microsoftonline.com` to your domain - for instance `https://contoso.com/auth`), cookies that were set by your app now fall under the new rules in Chrome. The cookies that need to be used in cross-site scenarios are cookies that hold the _state_ and _nonce_ values, that are also sent in the login request. There are other cookies dropped by Azure Active Directory (Azure AD) to hold the session.
3334

3435
If you don't update your web apps, this new behavior will result in authentication failures.
3536

@@ -39,17 +40,17 @@ To overcome the authentication failures, web apps authenticating with the Micros
3940
Other browsers (see [here](https://www.chromium.org/updates/same-site/incompatible-clients) for a complete list) follow the previous behavior of `SameSite` and won't include the cookies if `SameSite=None` is set.
4041
That's why, to support authentication on multiple browsers web apps will have to set the `SameSite` value to `None` only on Chrome and leave the value empty on other browsers.
4142

42-
This approach is demonstrated in our code samples below.
43+
This approach is demonstrated in the following sample code.
4344

4445
# [.NET](#tab/dotnet)
4546

46-
The table below presents the pull requests that worked around the SameSite changes in our ASP.NET and ASP.NET Core samples.
47+
The following table presents the pull requests that worked around the SameSite changes in our ASP.NET and ASP.NET Core samples.
4748

48-
| Sample | Pull request |
49-
| ------ | ------------ |
50-
| [ASP.NET Core web app incremental tutorial](https://github.com/Azure-Samples/active-directory-aspnetcore-webapp-openidconnect-v2) | [Same site cookie fix #261](https://github.com/Azure-Samples/active-directory-aspnetcore-webapp-openidconnect-v2/pull/261) |
51-
| [ASP.NET MVC web app sample](https://github.com/Azure-Samples/ms-identity-aspnet-webapp-openidconnect) | [Same site cookie fix #35](https://github.com/Azure-Samples/ms-identity-aspnet-webapp-openidconnect/pull/35) |
52-
| [active-directory-dotnet-admin-restricted-scopes-v2](https://github.com/azure-samples/active-directory-dotnet-admin-restricted-scopes-v2) | [Same site cookie fix #28](https://github.com/Azure-Samples/active-directory-dotnet-admin-restricted-scopes-v2/pull/28) |
49+
| Sample | Pull request |
50+
| ----------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------- |
51+
| [ASP.NET Core web app incremental tutorial](https://github.com/Azure-Samples/active-directory-aspnetcore-webapp-openidconnect-v2) | [Same site cookie fix #261](https://github.com/Azure-Samples/active-directory-aspnetcore-webapp-openidconnect-v2/pull/261) |
52+
| [ASP.NET MVC web app sample](https://github.com/Azure-Samples/ms-identity-aspnet-webapp-openidconnect) | [Same site cookie fix #35](https://github.com/Azure-Samples/ms-identity-aspnet-webapp-openidconnect/pull/35) |
53+
| [active-directory-dotnet-admin-restricted-scopes-v2](https://github.com/azure-samples/active-directory-dotnet-admin-restricted-scopes-v2) | [Same site cookie fix #28](https://github.com/Azure-Samples/active-directory-dotnet-admin-restricted-scopes-v2/pull/28) |
5354

5455
for details on how to handle SameSite cookies in ASP.NET and ASP.NET Core, see also:
5556

@@ -58,16 +59,16 @@ for details on how to handle SameSite cookies in ASP.NET and ASP.NET Core, see a
5859

5960
# [Python](#tab/python)
6061

61-
| Sample |
62-
| ------ |
63-
| [ms-identity-python-webapp](https://github.com/Azure-Samples/ms-identity-python-webapp) |
62+
| Sample |
63+
| --------------------------------------------------------------------------------------- |
64+
| [ms-identity-python-webapp](https://github.com/Azure-Samples/ms-identity-python-webapp) |
6465

6566
# [Java](#tab/java)
6667

67-
| Sample | Pull request |
68-
| ------ | ------------ |
69-
| [ms-identity-java-webapp](https://github.com/Azure-Samples/ms-identity-java-webapp) | [Same site cookie fix #24](https://github.com/Azure-Samples/ms-identity-java-webapp/pull/24)
70-
| [ms-identity-java-webapi](https://github.com/Azure-Samples/ms-identity-java-webapi) | [Same site cookie fix #4](https://github.com/Azure-Samples/ms-identity-java-webapi/pull/4)
68+
| Sample | Pull request |
69+
| ----------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------- |
70+
| [ms-identity-java-webapp](https://github.com/Azure-Samples/ms-identity-java-webapp) | [Same site cookie fix #24](https://github.com/Azure-Samples/ms-identity-java-webapp/pull/24) |
71+
| [ms-identity-java-webapi](https://github.com/Azure-Samples/ms-identity-java-webapi) | [Same site cookie fix #4](https://github.com/Azure-Samples/ms-identity-java-webapi/pull/4) |
7172

7273
---
7374

@@ -79,4 +80,4 @@ Learn more about SameSite and the Web app scenario:
7980

8081
- [Chromium SameSite page](https://www.chromium.org/updates/same-site)
8182

82-
- [Scenario: Web app that signs in users](scenario-web-app-sign-user-overview.md)
83+
- [Scenario: Web app that signs in users](scenario-web-app-sign-user-overview.md)

0 commit comments

Comments
 (0)