K Khan
Feb 3, 2020
  1741
(3 votes)

Will your site be effected in Chrome 80

Chrome 80 will treat cookies as SameSite=Lax by default if no SameSite attribute is specified and will reject insecure SameSite=None cookies.

Out of the box EPi Server's CMS website functionality isn't effected, but it might be effecting other areas of your website. e.g.

your integrations with Identity Providers using protocols such as SAML 2.0 or OpenID Connect or  analytics cookies that your web application creating as a third-party cookie or any feature depending on third party dependent cookies or if you are querying APIs from a third-party domain. 

References:

Google announced it would end support for third-party cookies in Chrome by 2022

Feb 03, 2020

Comments

Vincent
Vincent Feb 3, 2020 10:56 PM

Thank you for sharing this. 

According to MS doc, it's worth to note some forms of authentication e.g. OIDC and WS-Federation are not affected due to the differences in the how request flows (e.g. post based redirect). However applications use iframe got a lot of impact. 

K Khan
K Khan Feb 4, 2020 08:37 PM

@ Vincent, thanks for your input.

Vincent
Vincent Feb 4, 2020 11:45 PM

Furthermore, my colleague and I tested Episerver OOTB functionality by explicitly enabling samesite cookie settings in Chrome, both Commerce manager and personalization portal login stopped working. 

K Khan
K Khan Feb 5, 2020 11:56 AM

For, out of the box, can we assume it's the same as QuickSilver? in this case, this might affect more clients.

K Khan
K Khan Feb 6, 2020 10:10 PM

need to report I think, A cookie associated with a cross-site resource at https://dl.episerver.net/ was set without the `SameSite` attribute. A future release of Chrome will only deliver cookies with cross-site requests if they are set with `SameSite=None` and `Secure`. You can review cookies in developer tools under Application>Storage>Cookies and see more details at https://www.chromestatus.com/feature/5088147346030592 and https://www.chromestatus.com/feature/5633521622188032.

Please login to comment.
Latest blogs
Optimizely SendGrid SMTP host is deprecated

SendGrid is a services for sending email that is included in Optimizely DXP. Previously smtp.episerver.net was the recommended SMTP server to use,...

Tomas Hensrud Gulla | Dec 4, 2022 | Syndicated blog

Hosting Optimizely CMS 12 on Docker Engine

Since Optimizely CMS can now be deployed as a Docker container, here is a demonstration of building, running and scaling an Optimizely CMS 12 site ...

Stefan Holm Olsen | Dec 4, 2022 | Syndicated blog

How to use CacheTagHelper with content areas in Optimizely CMS 12

I might be going out on a limb here - if you have a better solution, feel very free to share it!  Upgrading your Optimizely web application from .N...

Andreas J | Dec 2, 2022

The 1001st Piece in your 1000 Piece Puzzle: .NET Default Interface Functions

I was recently working with a client who wanted a reasonably large subsystem added to Optimizely that would add automated management to their...

Greg J | Nov 28, 2022 | Syndicated blog

Video Demonstration, creating a CMS12 Alloy Sample Site

Hey All Below you will find a quick video demonstration on how to install a local version of Alloy Sample based on CMS12 / .Net 6. As you will see ...

Minesh Shah (Netcel) | Nov 28, 2022

How to create an admin user I Optimizely CMS – with Episerver CLI

In this blog post I’ll show how to create an admin user for Optimizely CMS in a new environment where you don’t have access to the admin interface.

Ove Lartelius | Nov 28, 2022 | Syndicated blog