Mozilla VPN is currently experiencing an outage. Our team is actively working to resolve the issue. Please check the status page for real-time updates. Thank you for your patience.

Αυτός ο ιστότοπος θα έχει περιορισμένη λειτουργικότητα, όσο εκτελούμε εργασίες συντήρησης για να βελτιώσουμε την εμπειρία σας. Αν ένα άρθρο δεν επιλύει το ζήτημά σας και θέλετε να κάνετε μια ερώτηση, η κοινότητα υποστήριξής μας είναι έτοιμη να σας βοηθήσει στο Twitter (@FirefoxSupport) και στο Reddit (/r/firefox).

Avatar for Username

Αναζήτηση στην υποστήριξη

Προσοχή στις απάτες! Δεν θα σας ζητήσουμε ποτέ να καλέσετε ή να στείλετε μήνυμα σε κάποιον αριθμό τηλεφώνου ή να μοιραστείτε προσωπικά δεδομένα. Αναφέρετε τυχόν ύποπτη δραστηριότητα μέσω της επιλογής «Αναφορά κατάχρησης».

Μάθετε περισσότερα

Αυτό το νήμα αρχειοθετήθηκε. Παρακαλούμε κάντε νέα ερώτηση αν χρειάζεστε βοήθεια.

Lax Cookie Not Sent in iFrame on 302 Redirection

  • 3 απαντήσεις
  • 1 έχει αυτό το πρόβλημα
  • 18 προβολές
  • Τελευταία απάντηση από brian.l.coker

brian.l.coker
brian.l.coker
more options

I’m building an Angular application that is using OAuth2 Auth Code w/PKCE. The app uses hidden iframes to silently renew access tokens. I found that when the OAuth2 authorization serve redirects the iFrame to {parent origin}/silent-refresh.html with a 302, Firefox does not send any cookies set with SameSite: Lax.

SameSite: None cookies are sent as expected.

I compared this with IE and Chrome and both of those browser send the Lax cookies on when redirecting due to a 302.

This problem seems to only occur when the iFrame is being redirected via 302 from a different origin. I.e requests from a basic iFrame to the parent page origin send Lax cookies with no problem.

Anyone experience this? Is this expected behavior for Firefox?

Firefox Version 68.8

I’m building an Angular application that is using OAuth2 Auth Code w/PKCE. The app uses hidden iframes to silently renew access tokens. I found that when the OAuth2 authorization serve redirects the iFrame to {parent origin}/silent-refresh.html with a 302, Firefox does not send any cookies set with SameSite: Lax. SameSite: None cookies are sent as expected. I compared this with IE and Chrome and both of those browser send the Lax cookies on when redirecting due to a 302. This problem seems to only occur when the iFrame is being redirected via 302 from a different origin. I.e requests from a basic iFrame to the parent page origin send Lax cookies with no problem. Anyone experience this? Is this expected behavior for Firefox? Firefox Version 68.8

Όλες οι απαντήσεις (3)

cor-el
cor-el
  • Moderator
  • Top 10 Contributor
more options

Does this also happen in current Firefox releases (current is 78.0.1) ?

There were some changes in Firefox 69.

brian.l.coker
brian.l.coker Ιδιοκτήτης ερώτησης
more options

I’m working on getting a new version. My corporate version of Firefox comes bundled with some MFA software. So it hasn’t been as easy as just downloading the latest and retesting.

brian.l.coker
brian.l.coker Ιδιοκτήτης ερώτησης
more options

Okay I was able to test this with 78.0.1 (64-bit) and the behavior is the same.