471 questions
1
vote
0
answers
132
views
Google Recaptcha v3 without third party cookies
I'm using the following Flutter package
https://pub.dev/packages/g_recaptcha_v3
When running my app on web I see the following warning in the warning in the console
_GRECAPTCHA www.google.com/...
1
vote
1
answer
57
views
Why is Spring Security setting CSRF cookie with SameSite=None attribute?
I have a Springboot application with Spring Security 6 and a single page application for frontend (Vue). I configured anti-CSRF using the exact same config as the one described in the documentation. ...
0
votes
0
answers
23
views
iframe which loads the other domain doesn't work in chrome
In my site, it uses iframe to load the view of other cross-site domain and it works in Edge(IE mode).
However, it doesn't work in Chrome.
After searching every minute, I found out that the default ...
0
votes
1
answer
116
views
How Samesite cookie settings works with iframes
I have to embed a page with iframe to a different domain page.
This iframe is loaded with a jwt token that authenticates the user in domain B.
This response, creates a session cookie and reloads the ...
0
votes
1
answer
81
views
How to update/set SameSite value from “Strict” to "Lax" in chrome, edge, safari browser?
How to update/set SameSite value from “Strict” to "Lax" in chrome, edge, safari browser?
The below answer is outdated
How to disable same site policy in Chrome?
No option available as ...
0
votes
0
answers
105
views
HTTP Cookie policy SameSite on localhost works on Safari but not Firefox or Chrome [SOLVED]
I am running a localhost development version of my website.
I am refactoring into subdomains and have a problem reading the session cookies (PHP and my own) across the subdomain boundaries.
I now have ...
0
votes
0
answers
44
views
Samesite strict and redirects within the same domain
Our policy was set to samesite = strict and most everything was working.
However one SSO (openId) login was not playing nicely.
User starts at ourdomain.com/login, hits the SSO button and gets ...
1
vote
0
answers
18
views
Set-Cookie is being set on redirection in ASP.NET MVC on .NET 4.7.2 . Why?
I am setting SameSite in Startup.Auth.cs like this:
CookiePath = "/; SameSite=Lax",
But for Login action, on redirection; the Set-Cookie value is being automatically set by the framework ...
0
votes
0
answers
46
views
I set a cookie from backend but the frontend requests are not able to include this cookie in the requests
I can see the cookie in the setHeaders for the login route .this is how i made request from frontend
const response = await fetch(apiurl, {
method: 'GET',
credentials: 'include',
});
server ...
0
votes
0
answers
84
views
Missing few Cookies (Only in Chrome browser) in the First-Party Site's Request Header When Redirecting (Status Code: 303) from a Third-Party Site
Chrome Browser Version: 126.0.6478.127 (Official Build) (arm64)
Used technologies:
ClientSide - Html, React.js, Javascript
ServerSide - GoLang
What I tried:
Step 1:
Setting a few cookies with ...
-1
votes
1
answer
293
views
Refresh Token cannot be written into the browser's cookies
I encountered a strange situation. My project uses an HTTP-only refresh token. After the user successfully completes the login verification, the backend sends an HTTP-only refresh token to the ...
0
votes
1
answer
94
views
set http only and samesite flag for cookies in lighttpd
We are using lighttpd web server in our code base. It is that we need to add Samesite and HTTP ONLY flags for the cookie.
I have gone through many examples but all are related to PHP and some other ...
0
votes
0
answers
73
views
why does samesite=strict attribute in cookies restrict anchor links?
I want to add cookies to my website for enhanced security, as I used to use a bad session storage method.
I noticed that there are three options for samesite attribute in cookies. the most secure one ...
1
vote
0
answers
89
views
SameSite attribute for cross-site cookies
I don't understand how SameSite attributes work in cross-site Cookies and probably I don't understand how cross-site cookies work. I have a few questions, the answer to which will help me a lot.
I ...
1
vote
1
answer
548
views
Why is Chrome web-security blocking my first party cookie?
I'm trying to go from a monolith hosting my api server and react SPA to seperate hosting options (on the same domain, just different subdomains).
I have my frontend hosted on app.domain.com and ...
0
votes
0
answers
281
views
SameSite issue with Quarkus and with Keycloak
When I am on the keycloak page:
Some cookies are misusing the recommended “SameSite“ attribute 6
Cookie “KEYCLOAK_IDENTITY” does not have a proper “SameSite” attribute value. Soon, cookies without the ...
0
votes
1
answer
498
views
Why is Sec-Fetch-Site: cross-site when redirecting to same-site
Flow:
GET https://abc.example.com:8445/desktop/container (protected resource, redirect for saml authentication) response 302
GET https://xyx.test.com:8553 - does saml authentication and redirects (...
0
votes
1
answer
220
views
NextJs not setting the cookie from django csrf_token
My nextjs application integrated with django has an authentication system based on csrftoken and sessionid. Once the nextjs application runs, it makes a request to the backend for the csrf route, ...
0
votes
1
answer
101
views
Browser is not sending the cookie with fetch, allthough server and frontend have the same ip address (but different ports)
Ialready tried many things, but the browser still refuses to set the Cookie header on any request I make in the frontend. Both server and frontend running on my local machine.
I created a hosts entry ...
1
vote
0
answers
616
views
Cookies on localhost not being set... what to do?
I have a frontend running on http://localhost:5173 and a backend running on http://localhost:3000. I just can't test cookies sent by the backend anymore... the POST response looks like this:
Access-...
-2
votes
1
answer
86
views
something weird with samesite cookies
If you access to this url from google (you can search it as literally to find it quickly in SERP):
https://www.b e b e m o v i l.com/inglesina-electa
cookies politic will be shown (blue div) and if ...
0
votes
1
answer
319
views
Angular SPA which is used as Frontend for my custom OIDC provider is not sending session cookie to my backend /signin API
Senario
I have a two angular Apps first one is a angular_shop an which use /auth endpoint for a custom node_oidc_provider to start auth request
node_oidc_provider the checks the PKCE code from ...
2
votes
0
answers
470
views
Can I recreate next-auth v4 session on the client side in iframe?
Situation:
Nextjs web application running in iframe cannot access auth provider to let user login.
Nextjs web application opens a popup window, loads same web application sign-in page and then ...
0
votes
0
answers
453
views
Passport.js - Chrome will not allow cross-site cookies
My frontend is hosted in (example.com) and backend in (api.example.com). This counts as cross-origin and I'm using Passport.js with Redis for sessions (with cookies). However, this Google Chrome ...
0
votes
0
answers
138
views
JSESSIONID cookie dropped and recreated upon receiving SSO response on iPhone app though SameSite policy is set
We have a java web application accessed from both browsers and iPhone app using spring security as the underline SSO implementation. Since added sameSiteCookies="strict" in tomcat context....
0
votes
1
answer
183
views
How is SameSite defined for domains which are not on the public suffix list?
According to https://web.dev/articles/samesite-cookies-explained?hl=en:
The introduction of the SameSite attribute (defined in RFC6265bis) allows you to declare if your cookie should be restricted to ...
0
votes
0
answers
121
views
Reasons samesite=none not sent
I have a service that relies on a samesite=none cookie. I have seen that this cookie is not sent for about 1% of users in a cross domain context. This is the exact case my site needs samesite=none, ...
0
votes
1
answer
1k
views
SpringBoot - How I can configure samesite none Csrf Cookie (Spring Security 6.2)
What I have:
I have sprint boot api, and angular app in diferents domains (not subdomains), and is not an option change it.
I only grant access by cors to my angular domain app.
What I need:
I need ...
3
votes
1
answer
4k
views
Chrome 3rd party cookie in iframe (SameSite=None; Secure)
Just like everyone else, I'm scrambling to support the coming 3rd-party-cookie change in Chrome. My users (other websites on other domains) include my webpage in an iframe. In my page I set a cookie (...
0
votes
0
answers
273
views
Why Cookies with SameSite=None aren't sent within an <iframe> in Firefox and Chrome?
I created a simple Web Server that sets a cookie with SameSite=None and Secure flag and tried to check if this cookie was then inserted in the next request made via Iframe
I created this simple Web ...
0
votes
0
answers
146
views
How to set property SameSite=None for a auth cookie autogenerated by user identity in .net?
I need to integrate the application in an iframe from another website. I manage to display the login page of the application in an iframe addind cors headers in the response. The application use .net ...
0
votes
0
answers
60
views
Samesite:Strict still sends the cookie
I am trying samesite:strict, but it is not working at all,
Server1 (running on http://localhost:5000/):
const express = require('express');
const cookieParser = require('cookie-parser');
var logger = ...
0
votes
0
answers
215
views
Set-Cookie header not setting a cookie with SameSite=None attribute
I'm trying to make a request from a client located on the domain a.com to a server running PrestaShop on the domain b.com. My goal is to obtain a cookie containing an authentication token. Although I ...
0
votes
1
answer
1k
views
Samesite=Strict behavior after oidc login
I am running a Client Application and Identity Server on localhost on different ports with http: and Identity Server has external login provider hosted on https:
I have configured Auth Server to set ...
0
votes
1
answer
183
views
Set cookie with duplicated attribute with different values
Let's say I try to set a cookie with 2 (or more!) SameSite attributes with different values, like:
CookienName=CookieValue; secure; SameSite=None; SameSite=Lax
Which value will be taken into account?
...
1
vote
0
answers
199
views
CSRF and SPA - how to secure cookies
CSRF & SPA
Hi,
I am currently trying to solve if CSRF is a problem for my SPA.
I have a ReactJS frontend application which communicates with my Spring boot backend. On successful login, two ...
0
votes
1
answer
772
views
How to display an app with auth cookies inside an iframe in a secure way?
I have a ASP.NET web application running in IIS that handles the authentication session with cookies.
A customer wants to display this application inside an iframe of another application. However, ...
0
votes
0
answers
428
views
Cypress cy.setCookie() won't properly save the cookie on production
Quick context: I've implemented a cookie consent banner and now all the current E2E test are showing it, so I've added it to a beforeEach and my banner reads from cookies-js as Cookies.get("...
1
vote
0
answers
368
views
Different interpretation of same-site (cross-site) in Firefox vs Chrome
i have two subdomains sub1.domain.com and sub2.domain.com (original domain names are different).
the web page of sub1.domain.com has a button to create a cookie with same-site:strict and secure ...
0
votes
0
answers
511
views
why SameSite Lax sends the cookie to POST XHR request to cross origin when credentials: 'include' is set?
As I read on the internet, SameSite=Lax can't send the cookie with POST XHR request to cross-origin. I tried to replicate this behavior
I hosted frontend on :8080
<button onclick="...
1
vote
1
answer
953
views
Keycloak uses samesite=None and failing in Pen test
I understand that Keycloak uses Samesite=None explicitly to work in SAML. I have situation where you can submit the form from cross domain.
For ex, Take the HTML content from the personal info form ...
1
vote
0
answers
172
views
How do I resolve SameSite issues when requesting a wms/image from geoserver?
I have an html file where I made a request of a wms/image from my geoserver instance using the image tag. When I open the html file in Chrome browser, on the web page, a broken image icon is shown ...
0
votes
1
answer
264
views
How Can An Attacker Exploit SameSite=Lax Cookies Using The `window` Object?
I'm trying to understand why a SameSite cookie attribute's Strict mode prevents cookies from being loaded during top-level navigation and similar. That is, how can an attacker possibly exploit a Lax ...
2
votes
1
answer
650
views
Whitelisting domains for samesite=strict cookies
I would like to keep my client website portal cookies set to samesite=strict, but then also allow specific 3rd party domains to do redirects back to my website to be able to use my site cookies to ...
0
votes
1
answer
103
views
Specifying sameSite doesnt do anything google auth session cookies
My session cookies are getting blocked and the network tab is showing me this:
image of the cookie in the network tab
Ive been stuck on this problem for three days and i dont know what to do
I tried ...
1
vote
0
answers
240
views
Samesite cookie error in Karate feature file
Whenever I get the token from openid I get the error also and my Karate feature becomes failure:
io.netty.handler.codec.http.cookie.DefaultCookie.sameSite()Lio/netty/handler/codec/http/cookie/...
0
votes
0
answers
67
views
Losing session cookie in iframe when using .net6
I have a cross site iframe, however it doesn't persist with session.
I've checked multiple answers on here and it's likely due to same site cookie policy however setting this to the recommended ...
0
votes
1
answer
340
views
How to set samesite cookie on wildfly 15?
My App Server is running an older version of Wildfly (v. 15.0.1.Final). The content served from the server is embedded within a partner site (as an IFrame). This embedded approach stopped rendering on ...
1
vote
2
answers
2k
views
Django & React - Session Authentication
I am using session authentication in my Django - React application.
But no session cookie is stored in the cookie storage.
(A csrf token cookie is stored!)
I cleared the local storage / session ...
0
votes
1
answer
262
views
SameSite error in my Django + React authentication app
SameSite error in my Django + React authentication app
Here's the image of the error
I have a simple React + Django authentication app I deployed just for testing. I'm using Django Rest Framework. ...