SameSite cookie attribute

Issue

• Users want to add a Strict attribute instead of None for sameSite to set the 'JSESSIONID' cookie

Environment

• Liferay DXP [7.1 - 7.4]

Resolution

• The application server or web server controls JSessionID cookies. Therefore, in the case of bundled tomcat, the tomcat app server will need to be set up accordingly. 
• The following are steps that can be taken at the Tomcat level to achieve the desired results:
  
  • Stop the application server
  • Please navigate to tomcat/conf/context.xml
  • Update the CookieProcessor element on the following lines for setting SameSiteCookies in HTTP response headers' set-cookie.
    

    <CookieProcessor className="org.apache.tomcat.util.http.LegacyCookieProcessor" sameSiteCookies="strict" />

  • Clear all temp folders [osgi/state, {liferayhome}/work, {liferayhome}/tomcat/work, {liferay_home}/tomcat/temp]
    
  • Restart the server
• In Tomcat < 9.0.28 (or < 8.5.48 for the 8.5x branch), the same-site attribute is not set if the value is NONE. This causes some issues with the session cookie in Chrome > 80. As a result, the above steps will not work if the Tomcat version is less than 9.0.28.
• Liferay is already working to have some option to set SameSite attribute to either Lax or Strict for all these cookies and everything would be set by LR engine itself. This can be tracked here: LPS-133584

Additional Information

• Users can look for a way to do the same at the web server level meanwhile, this might help them to achieve their desired results: security - PHP setcookie "SameSite=Strict"?
• Impact of Google Chrome 80 and changes in the default behavior of the SameSite cookie setting on SAML