Cloudflare Load Balancer session affinity cookie (__cflb) misconfiguration

Bungie-net / api

Resources for the Bungie.net API

Other

1.22k stars 92 forks source link

Cloudflare Load Balancer session affinity cookie (__cflb) misconfiguration #1928

Open nznaza opened 1 week ago

nznaza commented 1 week ago

Because __cflb cookie cross-site context “SameSite” is not marked as SameSite=None; Secure it will not be sent from third party websites, making web browser third party tools follow normal endpoint route for each request.

Bit more CF information