From 5965346bdf9479b5c78313604784afcea3ab2060 Mon Sep 17 00:00:00 2001 From: Binal Patel Date: Tue, 11 Aug 2026 19:58:07 -0600 Subject: [PATCH] Document the SameSite requirement for SAML reauthentication --- server/configs/application.properties | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/server/configs/application.properties b/server/configs/application.properties index 365ce22ce9..9e69cd353f 100644 --- a/server/configs/application.properties +++ b/server/configs/application.properties @@ -117,6 +117,19 @@ mail.smtpUser=@@smtpUser@@ # HTTP session timeout for users - defaults to 30 minutes #server.servlet.session.timeout=30m +# SAML IdPs return authentication assertions via a cross-site POST. Without an explicit SameSite value, +# Chrome browser treats JSESSIONID as Lax and withholds it from that POST, except during a grace period covering +# cookies less than two minutes old. Reauthentication deliberately never replaces the session -- the +# signed-in session is what it verifies against -- so the cookie only ages, and any reauthentication more +# than a couple of minutes after sign-in arrives with no session cookie. That fails two ways: the request +# looks like a guest, producing a misleading "wrong user reauthenticated" error, and the response mints a +# guest session whose Set-Cookie overwrites the signed-in JSESSIONID, logging the user out. SameSite=None +# keeps the session attached to the callback and is only honored on Secure cookies, +# so this requires HTTPS. +#server.servlet.session.cookie.same-site=none +#server.servlet.session.cookie.secure=true +#server.servlet.session.cookie.http-only=true + ## Turn on JSON-formatted HTTP access logging to stdout. See issue 48565 ## https://tomcat.apache.org/tomcat-9.0-doc/config/valve.html#JSON_Access_Log_Valve #jsonaccesslog.enabled=true