Revision as of 10:50, 8 May 2021 by Tom (Created page with "==Full Title or Meme== SameSite is an attribute in HTTP that is applied to the Cookie header. ==Context== Cross-site scripting (XSS) attacks have allows an attacker to se...")
Full Title or Meme
SameSite is an attribute in HTTP that is applied to the Cookie header.
- In particular Apple introduced a restriction on SameSite cookies that caused common implementations of OAuth 2.0 and OpenID Connect to fail. Brock Allen has decoded that issue on his site The basic problem with OAuth front channel Authentication is determining which site is the SameSite. So, while the authentication works, the redirect to the client code is not considered, by iOS 12, to be a same-site operation. Even in the case a refresh of the client site will work and be fully authenticated, because it is not a redirect, but a SameSite operation.
- SameSite cookies from Mozilla.