Saml2: SameSite Issue with Saml2 cookie after 2.4.0 update

[cip1337]

Using .NET 4.7.2 MVC

After updating to 2.4.0 most of the cookies are ok now beside saml2 one on return from Okta: it has the secure flag but not SameSite=None flag on address https://mysite/Saml2/Acs

We are using integration local idp with sustainsys to Okta as we have a custom STS implemented with System.IdentityModel.

FF 72 with "network.cookie.sameSite.laxByDefault" = true and "network.cookie.sameSite.noneRequiresSecure" = true it crashes with "No cookie preserving state from the request was found so the message was not expected to have an InResponseTo attribute" error:

Chrome 79 with "SameSite by default cookies" = true and "Cookies without SameSite must be secure" = true - it works because of 2 min grace period but gives a quick warning before deleting the cookie:

[AndersAbel]

After updating to 2.4.0 most of the cookies are ok now beside saml2 one on return from Okta. We are using integration sustainsys - Okta because we have a local idp:

What package are you using? Is this Asp.Net Core? Owin?

[cip1337]

After updating to 2.4.0 most of the cookies are ok now beside saml2 one on return from Okta. We are using integration sustainsys - Okta because we have a local idp:

What package are you using? Is this Asp.Net Core? Owin?

Sustainsys.Saml2.Mvc 2.4.0

[AndersAbel]

I tested it once again locally here and it works for me: set-cookie: Saml2.rrRGGN8C3m90qohEWuyUroMc=a1-lId3Cc4FWhzUkN8cJO0aYlTcICSZ79imUt6mXaNGO2qlUtWMdpXH9y9yGaMJfH05OVeoVyB7K9yczuMtdWg..; path=/; secure; HttpOnly; SameSite=None

Can you please check the set-cookie header in the response from /Saml2/SignIn? I just want to be sure that we are seeing the right cookies and not stale ones from previous login attempts.

What we also need to check is that you have the needed updates on your computer. There are a couple of KB articles referenced in https://docs.microsoft.com/en-us/dotnet/api/system.web.httpcookie.samesite?view=netframework-4.8. The patch for 4.7.2 is https://support.microsoft.com/sv-se/help/4524421/kb4524421. Without that patch, the old behaviour is to treat SameSite=None as "do not emit any samesite property". So even if the Saml2 library sets SameSite=None correctly, it won't end up in the set-cookie header.

Easiest way to check if you have that patch installed is to create an HttpCookie object and check the default value value of the SameSite property. With the patch it's -1 (meaning unspecified, do not send a SameSite attribute). Without the patch its None (value 0).

[cip1337]

You are right. After updating kb4524421 (or the cumulative https://support.microsoft.com/en-us/help/4535101/kb4535101-cumulative-update-for-net-framework ) it worked locally!

But it doesn't work on Azure App Service after deployment. Based on this article https://azure.microsoft.com/en-au/updates/app-service-samesite-cookie-update/ my app service version is not yet 86.0.7.148 (or later). So I guess I need to wait for them to also update (maybe same KB applied on .NET 4.7.2 server side)

[AndersAbel]

That was good news - for a moment I thought I had forgot something important. I released a total of 10 Nuget packages for this last week, so a mistake in one would not be unexpected.

Looks like we can close this then?