Unable to login without the sameSiteCookies="none"
How To articles are not official guidelines or officially supported documentation. They are community-contributed content and may not always reflect the latest updates to Liferay DXP. We welcome your feedback to improve How To articles!
While we make every effort to ensure this Knowledge Base is accurate, it may not always reflect the most recent updates or official guidelines.We appreciate your understanding and encourage you to reach out with any feedback or concerns.
legacy-article
learn-legacy-article-disclaimer-text
Issue
- Without the sameSiteCookies="none" setting up, some vital cookies (e.g., JSESSIONID) are not created at all, preventing portal access.
Resolution
-
This article: https://web.dev/samesite-cookies-explained/ explains the origin of the SameSite cookie and how it evolved to accommodate the requirements for avoiding CSRF attacks. The important part is the IETF proposal Incrementally Better Cookies. This introduced that cookies with "SameSite=None" (i.e. enabled for cross-site delivery) should also be marked as "Secure".
- Modern browsers comply with this standard and won't accept cookies with "SameSite=None" without being marked as "Secure". That is why the log-in issue occurs.
-
"Secure" cookies require a secure channel to be sent to the server https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies
It is also mentioned in Mozilla's documentation that some browsers allow sending "Secure" cookies on localhost without encryption. For example: Firefox allows it. This is why, the issue is not observable on this browser.
Additional Information
did-this-article-resolve-your-issue