search

DuendeSoftware / Support

Support for Duende Software products
21 stars 0 forks source link

Third Party Cookie and Identity Server #1380

Closed kkdeveloper7 closed 2 months ago

kkdeveloper7 commented 3 months ago

Which version of Duende IdentityServer are you using? 7

Which version of .NET are you using? 8

Describe the bug

A clear and concise description of what the bug is.

To Reproduce

Steps to reproduce the behavior.

Expected behavior

A clear and concise description of what you expected to happen.

Log output/exception with stacktrace

Additional context

According to google, in 2024 Q4 Third party cookies will be phased out, perhaps this will be extended here. I noticed that after login, Identity Server drops 2 cookies

  1. idsrv
  2. idsrv.session (this cookie is dropping with SameSite=None; Secure)

Since one of the cookies is dropped with SameSite=None, are we going to be affected by this? Anything we need to do going forward?

RolandGuijt commented 3 months ago

Google had the intention to do this but they decided to not implement the plan. See here.

For context: The idsrv.session cookie is required by the OIDC session management spec for JS/SPA clients and it implements this spec.

RolandGuijt commented 2 months ago

@kkdeveloper7 Did this answer your question? If not please add to this issue. If not I'd like to close it.

kkdeveloper7 commented 2 months ago

@kkdeveloper7 Did this answer your question? If not please add to this issue. If not I'd like to close it.

yes, thank you!