Does EasySSO SAML work with Strict SameSite Session Cookies?

Due to browser limitations, we have noticed some cases where session cookies being set with the SameSite=Strict attribute breaks SAML Authentication.

This seems to be browsers interpreting this value very strictly, and also enforcing it on same site redirects after a cross origin request. Essentially, after SAML authentication is complete and the user has a new session cookie, the browser does not send this cookie when redirected to the original destination page.

For example in Firefox: https://bugzilla.mozilla.org/show_bug.cgi?id=1465402

FishEye / Crucible

In recent versions of FeCru, this setting is enabled by default. You can update this setting in <fisheyeinstalldirectory>/content/WEB-INF/web.xml

<cookie-config>
    <name>FESESSIONID</name>
    <http-only>true</http-only>
    <comment>__SAME_SITE_NONE__</comment>
	<secure>true</secure>
</cookie-config>



EasySSO