Skip to main content
Just browsing Stack Overflow? Help us improve your experience. Sign up for research
Filter by
Sorted by
Tagged with
1 vote
0 answers
132 views

Google Recaptcha v3 without third party cookies

I'm using the following Flutter package https://pub.dev/packages/g_recaptcha_v3 When running my app on web I see the following warning in the warning in the console _GRECAPTCHA www.google.com/...
anonymous-dev's user avatar
1 vote
1 answer
57 views

Why is Spring Security setting CSRF cookie with SameSite=None attribute?

I have a Springboot application with Spring Security 6 and a single page application for frontend (Vue). I configured anti-CSRF using the exact same config as the one described in the documentation. ...
charlycou's user avatar
  • 1,968
0 votes
0 answers
23 views

iframe which loads the other domain doesn't work in chrome

In my site, it uses iframe to load the view of other cross-site domain and it works in Edge(IE mode). However, it doesn't work in Chrome. After searching every minute, I found out that the default ...
Jiwan Kim's user avatar
0 votes
1 answer
116 views

How Samesite cookie settings works with iframes

I have to embed a page with iframe to a different domain page. This iframe is loaded with a jwt token that authenticates the user in domain B. This response, creates a session cookie and reloads the ...
Tobia's user avatar
  • 9,474
0 votes
1 answer
81 views

How to update/set SameSite value from “Strict” to "Lax" in chrome, edge, safari browser?

How to update/set SameSite value from “Strict” to "Lax" in chrome, edge, safari browser? The below answer is outdated How to disable same site policy in Chrome? No option available as ...
Evans's user avatar
  • 1
0 votes
0 answers
105 views

HTTP Cookie policy SameSite on localhost works on Safari but not Firefox or Chrome [SOLVED]

I am running a localhost development version of my website. I am refactoring into subdomains and have a problem reading the session cookies (PHP and my own) across the subdomain boundaries. I now have ...
mhfadams's user avatar
0 votes
0 answers
44 views

Samesite strict and redirects within the same domain

Our policy was set to samesite = strict and most everything was working. However one SSO (openId) login was not playing nicely. User starts at ourdomain.com/login, hits the SSO button and gets ...
Rolf Herbert's user avatar
1 vote
0 answers
18 views

Set-Cookie is being set on redirection in ASP.NET MVC on .NET 4.7.2 . Why?

I am setting SameSite in Startup.Auth.cs like this: CookiePath = "/; SameSite=Lax", But for Login action, on redirection; the Set-Cookie value is being automatically set by the framework ...
Urja Sehgal's user avatar
0 votes
0 answers
46 views

I set a cookie from backend but the frontend requests are not able to include this cookie in the requests

I can see the cookie in the setHeaders for the login route .this is how i made request from frontend const response = await fetch(apiurl, { method: 'GET', credentials: 'include', }); server ...
Sneha Bakshi's user avatar
0 votes
0 answers
84 views

Missing few Cookies (Only in Chrome browser) in the First-Party Site's Request Header When Redirecting (Status Code: 303) from a Third-Party Site

Chrome Browser Version: 126.0.6478.127 (Official Build) (arm64) Used technologies: ClientSide - Html, React.js, Javascript ServerSide - GoLang What I tried: Step 1: Setting a few cookies with ...
Jakpren's user avatar
  • 91
-1 votes
1 answer
293 views

Refresh Token cannot be written into the browser's cookies

I encountered a strange situation. My project uses an HTTP-only refresh token. After the user successfully completes the login verification, the backend sends an HTTP-only refresh token to the ...
許漢昇's user avatar
0 votes
1 answer
94 views

set http only and samesite flag for cookies in lighttpd

We are using lighttpd web server in our code base. It is that we need to add Samesite and HTTP ONLY flags for the cookie. I have gone through many examples but all are related to PHP and some other ...
ramdhyani's user avatar
0 votes
0 answers
73 views

why does samesite=strict attribute in cookies restrict anchor links?

I want to add cookies to my website for enhanced security, as I used to use a bad session storage method. I noticed that there are three options for samesite attribute in cookies. the most secure one ...
a_duck's user avatar
  • 11
1 vote
0 answers
89 views

SameSite attribute for cross-site cookies

I don't understand how SameSite attributes work in cross-site Cookies and probably I don't understand how cross-site cookies work. I have a few questions, the answer to which will help me a lot. I ...
George Manlove's user avatar
1 vote
1 answer
548 views

Why is Chrome web-security blocking my first party cookie?

I'm trying to go from a monolith hosting my api server and react SPA to seperate hosting options (on the same domain, just different subdomains). I have my frontend hosted on app.domain.com and ...
John Cover's user avatar
0 votes
0 answers
281 views

SameSite issue with Quarkus and with Keycloak

When I am on the keycloak page: Some cookies are misusing the recommended “SameSite“ attribute 6 Cookie “KEYCLOAK_IDENTITY” does not have a proper “SameSite” attribute value. Soon, cookies without the ...
jnbdz's user avatar
  • 4,383
0 votes
1 answer
498 views

Why is Sec-Fetch-Site: cross-site when redirecting to same-site

Flow: GET https://abc.example.com:8445/desktop/container (protected resource, redirect for saml authentication) response 302 GET https://xyx.test.com:8553 - does saml authentication and redirects (...
Ayush Verma's user avatar
0 votes
1 answer
220 views

NextJs not setting the cookie from django csrf_token

My nextjs application integrated with django has an authentication system based on csrftoken and sessionid. Once the nextjs application runs, it makes a request to the backend for the csrf route, ...
Carlos Curcino's user avatar
0 votes
1 answer
101 views

Browser is not sending the cookie with fetch, allthough server and frontend have the same ip address (but different ports)

Ialready tried many things, but the browser still refuses to set the Cookie header on any request I make in the frontend. Both server and frontend running on my local machine. I created a hosts entry ...
Benny Alex's user avatar
1 vote
0 answers
616 views

Cookies on localhost not being set... what to do?

I have a frontend running on http://localhost:5173 and a backend running on http://localhost:3000. I just can't test cookies sent by the backend anymore... the POST response looks like this: Access-...
Bersan's user avatar
  • 3,403
-2 votes
1 answer
86 views

something weird with samesite cookies

If you access to this url from google (you can search it as literally to find it quickly in SERP): https://www.b e b e m o v i l.com/inglesina-electa cookies politic will be shown (blue div) and if ...
mdromed's user avatar
  • 79
0 votes
1 answer
319 views

Angular SPA which is used as Frontend for my custom OIDC provider is not sending session cookie to my backend /signin API

Senario I have a two angular Apps first one is a angular_shop an which use /auth endpoint for a custom node_oidc_provider to start auth request node_oidc_provider the checks the PKCE code from ...
Joel Joseph's user avatar
  • 6,159
2 votes
0 answers
470 views

Can I recreate next-auth v4 session on the client side in iframe?

Situation: Nextjs web application running in iframe cannot access auth provider to let user login. Nextjs web application opens a popup window, loads same web application sign-in page and then ...
RicardasJak's user avatar
0 votes
0 answers
453 views

Passport.js - Chrome will not allow cross-site cookies

My frontend is hosted in (example.com) and backend in (api.example.com). This counts as cross-origin and I'm using Passport.js with Redis for sessions (with cookies). However, this Google Chrome ...
Meli Fetaji's user avatar
0 votes
0 answers
138 views

JSESSIONID cookie dropped and recreated upon receiving SSO response on iPhone app though SameSite policy is set

We have a java web application accessed from both browsers and iPhone app using spring security as the underline SSO implementation. Since added sameSiteCookies="strict" in tomcat context....
Karl's user avatar
  • 1
0 votes
1 answer
183 views

How is SameSite defined for domains which are not on the public suffix list?

According to https://web.dev/articles/samesite-cookies-explained?hl=en: The introduction of the SameSite attribute (defined in RFC6265bis) allows you to declare if your cookie should be restricted to ...
leo's user avatar
  • 3,739
0 votes
0 answers
121 views

Reasons samesite=none not sent

I have a service that relies on a samesite=none cookie. I have seen that this cookie is not sent for about 1% of users in a cross domain context. This is the exact case my site needs samesite=none, ...
angryangryhippo's user avatar
0 votes
1 answer
1k views

SpringBoot - How I can configure samesite none Csrf Cookie (Spring Security 6.2)

What I have: I have sprint boot api, and angular app in diferents domains (not subdomains), and is not an option change it. I only grant access by cors to my angular domain app. What I need: I need ...
David Burgos's user avatar
3 votes
1 answer
4k views

Chrome 3rd party cookie in iframe (SameSite=None; Secure)

Just like everyone else, I'm scrambling to support the coming 3rd-party-cookie change in Chrome. My users (other websites on other domains) include my webpage in an iframe. In my page I set a cookie (...
logidelic's user avatar
  • 1,675
0 votes
0 answers
273 views

Why Cookies with SameSite=None aren't sent within an <iframe> in Firefox and Chrome?

I created a simple Web Server that sets a cookie with SameSite=None and Secure flag and tried to check if this cookie was then inserted in the next request made via Iframe I created this simple Web ...
awesomex35's user avatar
0 votes
0 answers
146 views

How to set property SameSite=None for a auth cookie autogenerated by user identity in .net?

I need to integrate the application in an iframe from another website. I manage to display the login page of the application in an iframe addind cors headers in the response. The application use .net ...
Bogdan's user avatar
  • 1
0 votes
0 answers
60 views

Samesite:Strict still sends the cookie

I am trying samesite:strict, but it is not working at all, Server1 (running on http://localhost:5000/): const express = require('express'); const cookieParser = require('cookie-parser'); var logger = ...
Omar AlHadidi's user avatar
0 votes
0 answers
215 views

Set-Cookie header not setting a cookie with SameSite=None attribute

I'm trying to make a request from a client located on the domain a.com to a server running PrestaShop on the domain b.com. My goal is to obtain a cookie containing an authentication token. Although I ...
SpritS's user avatar
  • 13
0 votes
1 answer
1k views

Samesite=Strict behavior after oidc login

I am running a Client Application and Identity Server on localhost on different ports with http: and Identity Server has external login provider hosted on https: I have configured Auth Server to set ...
Gopal Zadafiya's user avatar
0 votes
1 answer
183 views

Set cookie with duplicated attribute with different values

Let's say I try to set a cookie with 2 (or more!) SameSite attributes with different values, like: CookienName=CookieValue; secure; SameSite=None; SameSite=Lax Which value will be taken into account? ...
Tao Gómez Gil's user avatar
1 vote
0 answers
199 views

CSRF and SPA - how to secure cookies

CSRF & SPA Hi, I am currently trying to solve if CSRF is a problem for my SPA. I have a ReactJS frontend application which communicates with my Spring boot backend. On successful login, two ...
Adam Ostrožlík's user avatar
0 votes
1 answer
772 views

How to display an app with auth cookies inside an iframe in a secure way?

I have a ASP.NET web application running in IIS that handles the authentication session with cookies. A customer wants to display this application inside an iframe of another application. However, ...
Tao Gómez Gil's user avatar
0 votes
0 answers
428 views

Cypress cy.setCookie() won't properly save the cookie on production

Quick context: I've implemented a cookie consent banner and now all the current E2E test are showing it, so I've added it to a beforeEach and my banner reads from cookies-js as Cookies.get("...
Duveral's user avatar
  • 335
1 vote
0 answers
368 views

Different interpretation of same-site (cross-site) in Firefox vs Chrome

i have two subdomains sub1.domain.com and sub2.domain.com (original domain names are different). the web page of sub1.domain.com has a button to create a cookie with same-site:strict and secure ...
John George's user avatar
0 votes
0 answers
511 views

why SameSite Lax sends the cookie to POST XHR request to cross origin when credentials: 'include' is set?

As I read on the internet, SameSite=Lax can't send the cookie with POST XHR request to cross-origin. I tried to replicate this behavior I hosted frontend on :8080 <button onclick="...
Mohit Kumar's user avatar
1 vote
1 answer
953 views

Keycloak uses samesite=None and failing in Pen test

I understand that Keycloak uses Samesite=None explicitly to work in SAML. I have situation where you can submit the form from cross domain. For ex, Take the HTML content from the personal info form ...
Selvakumar Ponnusamy's user avatar
1 vote
0 answers
172 views

How do I resolve SameSite issues when requesting a wms/image from geoserver?

I have an html file where I made a request of a wms/image from my geoserver instance using the image tag. When I open the html file in Chrome browser, on the web page, a broken image icon is shown ...
bobbynaira's user avatar
0 votes
1 answer
264 views

How Can An Attacker Exploit SameSite=Lax Cookies Using The `window` Object?

I'm trying to understand why a SameSite cookie attribute's Strict mode prevents cookies from being loaded during top-level navigation and similar. That is, how can an attacker possibly exploit a Lax ...
wthlolbbq's user avatar
2 votes
1 answer
650 views

Whitelisting domains for samesite=strict cookies

I would like to keep my client website portal cookies set to samesite=strict, but then also allow specific 3rd party domains to do redirects back to my website to be able to use my site cookies to ...
rolinger's user avatar
  • 3,048
0 votes
1 answer
103 views

Specifying sameSite doesnt do anything google auth session cookies

My session cookies are getting blocked and the network tab is showing me this: image of the cookie in the network tab Ive been stuck on this problem for three days and i dont know what to do I tried ...
Mark Vitko's user avatar
1 vote
0 answers
240 views

Samesite cookie error in Karate feature file

Whenever I get the token from openid I get the error also and my Karate feature becomes failure: io.netty.handler.codec.http.cookie.DefaultCookie.sameSite()Lio/netty/handler/codec/http/cookie/...
user2111632's user avatar
0 votes
0 answers
67 views

Losing session cookie in iframe when using .net6

I have a cross site iframe, however it doesn't persist with session. I've checked multiple answers on here and it's likely due to same site cookie policy however setting this to the recommended ...
Sean T's user avatar
  • 2,494
0 votes
1 answer
340 views

How to set samesite cookie on wildfly 15?

My App Server is running an older version of Wildfly (v. 15.0.1.Final). The content served from the server is embedded within a partner site (as an IFrame). This embedded approach stopped rendering on ...
user3078422's user avatar
1 vote
2 answers
2k views

Django & React - Session Authentication

I am using session authentication in my Django - React application. But no session cookie is stored in the cookie storage. (A csrf token cookie is stored!) I cleared the local storage / session ...
Louis Eiden's user avatar
0 votes
1 answer
262 views

SameSite error in my Django + React authentication app

SameSite error in my Django + React authentication app Here's the image of the error I have a simple React + Django authentication app I deployed just for testing. I'm using Django Rest Framework. ...
Sai Dongargaonkar's user avatar

1
2 3 4 5
10