Cookie Same Site Attribute After Chrome Update

  • Hello,

    for the single logout to work in the current Chrome Version the Cookies set by the plugin need to be set with “SameSite=None”.

    Is there a way to set this up in the options? Or will there be an update to fix this?

    Kind regards,
    Andreas

Viewing 2 replies - 1 through 2 (of 2 total)
  • Plugin Author sixtomartin

    (@sixtomartin)

    The extension logs the user with the method:
    wp_set_current_user($user_id);

    and also set some cookie values that I guess is where you are experiencing the issues:

    wp_set_auth_cookie($user_id, $rememberme);

    setcookie(SAML_LOGIN_COOKIE, 1, time() + YEAR_IN_SECONDS, SITECOOKIEPATH );
    setcookie(SAML_NAMEID_COOKIE, $auth->getNameId(), time() + YEAR_IN_SECONDS, SITECOOKIEPATH );
    setcookie(SAML_SESSIONINDEX_COOKIE, $auth->getSessionIndex(), time() + YEAR_IN_SECONDS, SITECOOKIEPATH );
    setcookie(SAML_NAMEID_FORMAT_COOKIE, $auth->getNameIdFormat(), time() + YEAR_IN_SECONDS, SITECOOKIEPATH );

    I will review if something needs to be changed

    @andbecker87

    Can you verify if this code change solves your issue?
    https://github.com/onelogin/wordpress-saml/commit/f57561f65e38459a4c4de9ebf2a91af1a7b34ec9

    Otherwise, try to set the cookies like:

    $secure = is_ssl();
    $options = [
    ‘expires’ => time() + MONTH_IN_SECONDS
    ‘path’ => SITECOOKIEPATH,
    ‘domain’ => COOKIE_DOMAIN,
    ‘secure’ => $secure,
    ‘httponly’ => true,
    ‘samesite’ => ‘None’ // None || Lax || Strict
    ];

    setcookie(SAML_LOGIN_COOKIE, 1, $options);
    setcookie(SAML_NAMEID_COOKIE, $auth->getNameId(), $options);
    setcookie(SAML_SESSIONINDEX_COOKIE, $auth->getSessionIndex(), $options);
    setcookie(SAML_NAMEID_FORMAT_COOKIE, $auth->getNameIdFormat(), $options);
    setcookie(SAML_NAMEID_NAME_QUALIFIER_COOKIE, $auth->getNameIdNameQualifier(),$options);
    setcookie(SAML_NAMEID_SP_NAME_QUALIFIER_COOKIE, $auth->getNameIdSPNameQualifier(), $options);

Viewing 2 replies - 1 through 2 (of 2 total)
  • The topic ‘Cookie Same Site Attribute After Chrome Update’ is closed to new replies.