{"id":4061,"date":"2020-01-29T11:19:31","date_gmt":"2020-01-29T18:19:31","guid":{"rendered":"https:\/\/developer.microsoft.com\/en-us\/office\/blogs\/?p=4061"},"modified":"2020-01-29T11:19:31","modified_gmt":"2020-01-29T18:19:31","slug":"impact-on-authentication-from-samesite-changes-in-chrome","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/microsoft365dev\/impact-on-authentication-from-samesite-changes-in-chrome\/","title":{"rendered":"Impact on Authentication from SameSite\u00a0changes in\u00a0Chrome\u00a0"},"content":{"rendered":"

Following<\/span>\u00a0the\u00a0<\/span>recent\u00a0<\/span>updates<\/span>\u00a0<\/span>to the\u00a0<\/span>standards\u00a0<\/span>of\u00a0<\/span>SameSite<\/span><\/a> standards for <\/span>cookies<\/span>, Chrome is implementing changes<\/a> to the default behavior of SameSite in version 80 of the browser (releasing February 17th<\/sup>)<\/span>. T<\/span>hese changes <\/span>provide<\/span> protection\u00a0<\/span>for web applications <\/span>against Cross-Site Request Forgery<\/span>\u00a0<\/span>(CSRF)<\/span> by restricting cookies being sent on\u00a0<\/span>requests from other sites<\/span>.<\/span>\u00a0<\/span><\/p>\n

Web applications<\/span>\u00a0using\u00a0<\/span>OpenID Connect<\/span><\/a> form_post flow (updated link to auth code flow which actually uses form_post) for authentication\u00a0rely on cross-domain cookies for security and these flows are likely to fail on the new version of Chrome.\u00a0Web application developers are recommended to test and update their application\u00a0code to handle SameSite property\u00a0for Chrome and other browsers.<\/p>\n

You can find\u00a0<\/span>detailed<\/span>\u00a0information\u00a0<\/span>on<\/span>\u00a0<\/span>the impact of\u00a0<\/span>SameSite<\/span>\u00a0changes<\/span>\u00a0on authentication<\/span>\u00a0<\/span>as well as\u00a0<\/span>the mitigations and\u00a0<\/span>code\u00a0<\/span>samples to handle this issue on different web platforms in<\/span> the article:<\/span>\u00a0<\/span>Handle\u00a0<\/span>SameSite<\/span>\u00a0cookie changes in Chrome browser<\/span><\/a>.\u00a0<\/span>\u00a0<\/span><\/p>\n

As always,\u00a0<\/span>please reach us<\/span>\u00a0for support<\/span>\u00a0through Git<\/span>H<\/span>ub and\u00a0<\/span>Stackov<\/span>erflow<\/span><\/a>.<\/span>\u00a0<\/span><\/p>\n

-\u202fThe\u202fMicrosoft identity platform\u202fteam<\/span>\u202f<\/span>\u00a0<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

Following\u00a0the\u00a0recent\u00a0updates\u00a0to the\u00a0standards\u00a0of\u00a0SameSite\u00a0property in HTTP\u00a0cookies,\u00a0Chrome has announced\u00a0changes\u00a0to the default behavior of\u00a0SameSite\u00a0in\u00a0an upcoming release\u00a0of the browser\u00a0in February.\u00a0Web application developers are recommended to\u00a0update their application\u00a0code to handle different\u00a0SameSite\u00a0properties\u00a0on Chrome and other browsers.\u00a0<\/p>\n","protected":false},"author":69081,"featured_media":25159,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[5],"tags":[22],"class_list":["post-4061","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-microsoft-identity-platform","tag-azure-ad"],"acf":[],"blog_post_summary":"

Following\u00a0the\u00a0recent\u00a0updates\u00a0to the\u00a0standards\u00a0of\u00a0SameSite\u00a0property in HTTP\u00a0cookies,\u00a0Chrome has announced\u00a0changes\u00a0to the default behavior of\u00a0SameSite\u00a0in\u00a0an upcoming release\u00a0of the browser\u00a0in February.\u00a0Web application developers are recommended to\u00a0update their application\u00a0code to handle different\u00a0SameSite\u00a0properties\u00a0on Chrome and other browsers.\u00a0<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-json\/wp\/v2\/posts\/4061","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-json\/wp\/v2\/users\/69081"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-json\/wp\/v2\/comments?post=4061"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-json\/wp\/v2\/posts\/4061\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-json\/wp\/v2\/media\/25159"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-json\/wp\/v2\/media?parent=4061"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-json\/wp\/v2\/categories?post=4061"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-json\/wp\/v2\/tags?post=4061"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}