Chrome v80 "SameSite" changes and how it affects your Akumina installation

  • Updated
Follow

Chrome v80 has introduced some new security settings which do not honor cookies that specify if they can be used in the SameSite origin or not.

Additional Documentation

Resolution

There are 4 options to resolve this issue:

  1. Disable the new security enhancement in Chrome v80 (workaround/short term option)
  2. Suggest the user temporarily change browsers until a permanent configuration change is made (workaround/short term option)
  3. Update the web.config configuration within IIS  (may need to contact Akumina)
  4. Upgrade your Akumina application to v4.8 (which will require no modification to IIS)

Disable the new security enhancement

The settings that control this within Chrome v80 may be found by:

  1. Navigate to Chrome's settings or type this into your browser address field:
    chrome://flags
  2. Search for 'SameSite'
  3. Find the "SameSite by default cookies" line
  4. Change from "Default" to "Disabled"

Before:

mceclip0.png

After:

mceclip1.png

Update the web.config configuration within IIS

  1. In web.config look for the following:
    </system.webServer>
  2. Above that line, add: 
    <rewrite>
    <outboundRules>
    <rule name="AddSameSiteCookieFlag">
    <match serverVariable="RESPONSE_Set-Cookie" pattern="^(.*)(AKAPP|AKDWP)(=.*)$" />
    <action type="Rewrite" value="{R:0};SameSite=None;Secure;" />
    </rule>
    </outboundRules>
    </rewrite>

Final:

<rewrite>
 <outboundRules>
 <rule name="AddSameSiteCookieFlag">
 <match serverVariable="RESPONSE_Set-Cookie" pattern="^(.*)(AKAPP|AKDWP)(=.*)$" />
 <action type="Rewrite" value="{R:0};SameSite=None;Secure;" />
 </rule>
 </outboundRules>
 </rewrite>
</system.webServer>

Upgrade your Akumina application to v4.8

The next major release of Akumina (v4.8, due Q1 2020) will include updates that resolve this issue.

Related articles