0

I try to get the JSESSIONID cookie added to my request after a redirect from a third-party server.

When the user first accesses the App, it returns the JSESSIONID with attribute SameSite=Lax. Then the user authenticates to the Keycloak server, which redirects the user to the App after authentication succeeded.

The problem is that it works with Chromium - that is the JSESSIONID cookie is passed to the App in the redirected request - but it fails with Firefox with the following message in the console : Cookie “JSESSIONID” with the “SameSite” attribute value “Lax” or “Strict” was omitted because of a cross-site redirect.

I guess Firefox assumes it's a cross site requests because, though Lax was used and the request is Safe, it is not a Top Level Navigation. But it's weird that Chromium does not treat it as a cross-site request as well.

When I put the App and Keycloak servers in the same domain then it works as it is no longer a cross-site request, but we have other similar use cases with servers we don't have control over their domain, for example online payment server.

Do you know if there is a solution to get this work with all browsers, beside using SameSite=None.

Thanks,

3
  • Why do you say "it is not a top-level navigation"? Does it happen in an iframe? Feb 25, 2023 at 7:40
  • No IFrame, but the request to the Keycloak server is triggered by the App, so I guessed it was not a Top Level navigation. I investigated the Firefox source code since then and I think my guess is confirmed by the code from CookieService.cpp. The message I got in the console comes from there: link The blockCookie value is set from there: link So I think it comes from the return aIsSafeTopLevelNav; Feb 27, 2023 at 16:41
  • The behavior you observed on Firefox is in accordance with developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/…. For a more detailed answer, please include details about the requests in your question. Feb 27, 2023 at 16:55

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.