5

I have a static website on an Azure web server/portal that holds our company's documentation. Recently, I've been making changes to our code that sets our cookies to ensure that they comply with the browser SameSite requirement as explained here: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite

I've been able to fix all my scripts that create my cookies, but while testing them today, I see that there's this cookie message that still appears in my FireFox console:

Cookie “ARRAffinity” will be soon rejected because it has the “sameSite” attribute set to “none” or an invalid value, without the “secure” attribute. To know more about the “sameSite“ attribute, read https://developer.mozilla.org/docs/Web/HTTP/Headers/Set-Cookie/SameSite

This message only appears when I clear the cache from the site and load the page. Once I reload the page a second time or load any other page after that, I no longer see the message.

I believe this ARRAffinity cookie technically comes from Azure's Application Insights (AI)--or something on the Azure web server. It doesn't appear in our javascript files at all. We use AI for our analytics. Here is the code snippet that we got from Azure about two years ago. It gets injected into the header of each .htm page on our site:

var appInsights=window.appInsights||function(a){
        function b(a){c[a]=function(){var b=arguments;c.queue.push(function(){c[a].apply(c,b)})}}var c={config:a},d=document,e=window;setTimeout(function(){var b=d.createElement("script");b.src=a.url||"https://az416426.vo.msecnd.net/scripts/a/ai.0.js",d.getElementsByTagName("script")[0].parentNode.appendChild(b)});try{c.cookie=d.cookie}catch(a){}c.queue=[];for(var f=["Event","Exception","Metric","PageView","Trace","Dependency"];f.length;)b("track"+f.pop());if(b("setAuthenticatedUserContext"),b("clearAuthenticatedUserContext"),b("startTrackEvent"),b("stopTrackEvent"),b("startTrackPage"),b("stopTrackPage"),b("flush"),!a.disableExceptionTracking){f="onerror",b("_"+f);var g=e[f];e[f]=function(a,b,d,e,h){var i=g&&g(a,b,d,e,h);return!0!==i&&c["_"+f](a,b,d,e,h),i}}return c
    }({
        instrumentationKey:"<The Key>"
    });

    window.appInsights=appInsights,appInsights.queue&&0===appInsights.queue.length&&appInsights.trackPageView(); 

(Note that <The Key> in the snippet above is actually a unique multi-character string that Azure gave us when we set up and configured the AI resource. I removed it here for privacy.)

I've since revisited the site where I got that code, but the snippet has changed to something newer: https://learn.microsoft.com/en-us/azure/azure-monitor/app/javascript#snippet-based-setup

I'm not sure if I need to do anything to fix this.

Does ARRAffinity cookie come from some server-side script that Microsoft creates? Do I need to do anything on my side to resolve this console message? If so, what?

3
  • 1
    Does this answer your question? Asp.net Web Api stop using ARRAffinity cookie Commented Jul 31, 2020 at 17:55
  • the ARRAffinity cookie is from azure websites, not from application insights. see stackoverflow.com/questions/43105298/… ? Commented Jul 31, 2020 at 17:56
  • Thanks @JohnGardner. Yeah, I just noticed that same thing a few minutes ago myself when I was checking out a different page that didn't use our Application Insights code and I noticed it had the ARRAffinity cookie. I looked at the link you posted but I don't see that exact setting in my Azure portal but that post is 3 years old. I'll get with my system admin and see if we can find it.
    – Jared
    Commented Jul 31, 2020 at 19:41

1 Answer 1

4

ARRAffinity cookie is automatically created by Azure. You can turn it off by going to Configuration --> General Settings and then click on Off in the App Service as shown below.

enter image description here

As your's is a static website, i don't think this would be an issue. In fact, it is recommenced to turn ARR Affinity to Off for any Cloud Native applications.

When ARR Affinity is turned off, all the App Service instances (in a load balanced env) will be used effectively.

If ARR Affinity is turned on, all the requests for a given session will be sent to the same server irrespective of the load on it.

By default, the setting is on to to support legacy applications that needs Session stickiness.

2
  • Thank you. I can verify that the cookie was removed by following your steps. Hopefully, I don't really need it.
    – Jared
    Commented Aug 3, 2020 at 12:01
  • Yes. As it is a static website. It's not required. But, if you think in future, if you want to enable load balancing with multiple App Service Plan instances and you want to effectively utilize all the servers, you would have to enable it back.
    – Prawin
    Commented Aug 3, 2020 at 12:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.