SameSite should be set to None

[Shaochun-Chao]

The saml_session can't be stored in the Chrome cookie when the samesite value is "None". It works good for the Firefox, but not for Chrome. My Chrome version is 104.0.5112.101. I think it will be better just set the value as None(remove double quotes). Or any other solution to fix this problem? Please Guide, Thanks.

[peppelinux]

Which Django version are you using?

[Shaochun-Chao]

I have tested it with Django 4.0.5

[peppelinux]

Is your implementation on https and cookie Is set to SECURE?

[Shaochun-Chao]

Our project is on http currently and I didn't add SESSION_COOKIE_SECURE = True to my settings. Below is part of my settings

DEBUG = True

ALLOWED_HOSTS = ['*'] CORS_ALLOW_ALL_ORIGINS = True CORS_ALLOW_CREDENTIALS = True

INSTALLED_APPS = [ 'django.contrib.admin', 'django.contrib.auth', 'django.contrib.contenttypes', 'django.contrib.sessions', 'django.contrib.messages', 'django.contrib.staticfiles', 'sdwan_overlay_hub', 'rest_framework', 'rest_framework.authtoken', "djangosaml2",

'dj_rest_auth',

'drf_yasg',
'corsheaders',

]

MIDDLEWARE = [ 'django.middleware.security.SecurityMiddleware', 'django.contrib.sessions.middleware.SessionMiddleware', 'django.middleware.common.CommonMiddleware', 'django.middleware.csrf.CsrfViewMiddleware', 'django.contrib.auth.middleware.AuthenticationMiddleware', 'django.contrib.messages.middleware.MessageMiddleware', 'django.middleware.clickjacking.XFrameOptionsMiddleware', 'portal.middleware.SamlSessionMiddleware', 'corsheaders.middleware.CorsMiddleware', ]

SESSION_ENGINE = "portal.session" SESSION_REDIS = { 'host': 'redis', 'port': 6379, 'db': 0, 'prefix': 'session', 'socket_timeout': 1, 'retry_on_timeout': False }

[peppelinux]

It must be on https, otherwise allow unsolicited_responses in the pysaml2 configuration

[Shaochun-Chao]

I've set allow_unsolicited = True in the SAML_CONFIG. The interesting part is why my code works in the Firefox browser but not in Chrome browser. Is there any reason why you have to set Samesite as a string "None".

[peppelinux]

it's a security policy of chrome, that's all

to avoid troubles you shouldn't use http but only https, secure the cookies and disable samesite for the saml2 cookie

[Shaochun-Chao]

That make sense, I will implement my project on the https in the future. Thank you for your help.