Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

SSO login not working in iframe after chrome update

I have an app that lists different in-house and third party apps. There are some apps that are opened in iframe within my app and some of them are SSO enabled. Recently after chrome update to version 84.0.4147.125 the SSO login stopped working for apps in iframe, its working fine when opened in a new browser window.

This behavior isn't occurring in any other browser except Chrome, can any one assist me with this?

like image 318
IntelligentCancer Avatar asked Aug 13 '20 15:08

IntelligentCancer


People also ask

Why is iFrame not working in Chrome?

The iFrame has not configured – see suggestions in console – iFrame is most likely disabled. Your browser does not support frames, so you will not be able to view this page – You are using a browser that doesn't support iFrame. iFrame not loading in Chrome unless the window is resized – Resize the window to load iFrame.

How do I enable SSO in Chrome?

On the left, click SettingsUnder Single sign-on cookie behavior, select Enable transfer of SAML SSO cookies into user session during sign-in from the list. For more details, see Set Chrome device policies. Click Save.

How do I allow cookies in iFrame?

It works in all browsers except for Chrome. Set secure:false or secure:true for the cookie. Set sandbox="allow-same-origin allow-scripts" for the iframe, or remove the sandbox attribute.


1 Answers

Root cause:

Certain cookies are set without the SameSite attribute. They must be been blocked, as newer version of Chrome now only delivers cookies with cross-site requests if they are set with SameSite=None and Secure

To validate this, you can set Chrome flag chrome://flags/#same-site-by-default-cookies as Disabled

Chrome flag toggle for 'same site by default' setting

Resolution:

  • Specify SameSite=None and Secure if the cookie should be sent in cross-site requests. This enables third-party use.
  • Specify SameSite=Strict or SameSite=Lax if the cookie should not be sent in cross-site requests
like image 195
Dev P Avatar answered Nov 14 '22 01:11

Dev P