SameSite := ssoNone is not added to header response

[mhammady]

I need my app to be used from an iframe. When I set up a standalone server to use SSL and set CookieOptions.SameSite=ssoNone, the SameSite=None is not written resulting in the web browser considering it absent and defaulting to SameSite=Lax

I've seen this behavior in Chrome & Edge. With Firefox if SameSite=None is missing consider it as "None"

Can anyone please advise why SameSite is not showing when set to None?

PS: IW15.2.65

Thank you

[Alexandre Machado]

Not sure how to change this behaviour without changing IW's source code... Browsers are adopting Lax whenever the attribute is empty or doesn't exist, indeed.

I'll give it a thought. In our code base this has been fixed already

[mhammady]

Thanks Alex, so the solution is to upgrade to the latest version? Fixed in v 15.4.x?

[Alexandre Machado]

It will be available in the next update. If you've been using the latest version, please wait a few more days and we can release an update for it.