Forum > SameSite := ssoNone is not added to header response

10-14-2023, 01:55 AM:

I need my app to be used from an iframe. When I set up a standalone server to use SSL and set CookieOptions.SameSite=ssoNone, the SameSite=None is not written resulting in the web browser considering it absent and defaulting to SameSite=Lax

I've seen this behavior in Chrome & Edge. With Firefox if SameSite=None is missing consider it as "None"

Can anyone please advise why SameSite is not showing when set to None?

PS: IW15.2.65

Thank you

10-16-2023, 11:05 PM:

Not sure how to change this behaviour without changing IW's source code... Browsers are adopting Lax whenever the attribute is empty or doesn't exist, indeed.

I'll give it a thought. In our code base this has been fixed already

10-17-2023, 11:44 AM:

Thanks Alex, so the solution is to upgrade to the latest version? Fixed in v 15.4.x?

10-17-2023, 09:50 PM:

It will be available in the next update. If you've been using the latest version, please wait a few more days and we can release an update for it.