SameSite Cookie Changes Rolled Back Until Summer -- Redmondmag.com

SameSite Cookie Changes Rolled Back Until Summer

By Kurt Mackie
04/06/2020

The Chromium Project announced on Friday that it's delaying enforcement of SameSite cookie changes, and is temporarily rolling back those changes, because of the COVID-19 turmoil.

The new goal is to resume the SameSite changes sometime "over the summer," according to the announcement. The new plans apply to the stable releases of Chromium-based browsers (Chrome, Edge and Opera), but doesn't wholly apply to nonstable browser releases.

"Non-stable Chrome channels (e.g. Dev, Canary, and Beta) will continue with 50% enablement in Chrome 80 and later," the Chromium project clarified at its SameSite Updates page.

This SameSite change, which kicked off in February, attempts to avoid possible cross-site request forgery attempts using cookies. The Chromium project, following an Internet Engineering Task Force draft proposal, is aiming to enforce the "Lax" attribute when no SameSite value is declared in a site's header. If the SameSite attribute is declared as "None," then site owners have to add a Secure attribute, compelling cookie data to use the more secure HTTPS protocol.

This SameSite change is of note to Web site owners, as it affects how "third-party" cookies function. However, Microsoft also had warned back in January that various Microsoft applications could be affected by the SameSite behavioral change.

For instance, the SameSite change could affect ASP.NET Web sites and applications based on OpenID federation, including Microsoft Teams and SharePoint provider-hosted App Parts add-ins. Organizations using Windows Server 2016 and Windows Server 2019 will need certain January updates in place, as well.

The Chromium Project plans to provide further notice about its SameSite plans, which will get announced via the SameSite Updates page.

About the Author

Kurt Mackie is senior news producer for 1105 Media's Converge360 group.

Featured

Using Configuration Files to Control PowerShell Scripts, Part 2: Building Blocks

Learn how to use PowerShell's GUI capabilities to dynamically create configuration files that enhance script flexibility and usability.
U.S. House Leaders Unveil Bipartisan Strategy for AI Governance and Innovation

On Tuesday, U.S. House Speaker Mike Johnson and Democratic Leader Hakeem Jeffries received the final report from the bipartisan House Task Force on Artificial Intelligence, which outlines essential principles and recommendations to bolster American leadership in AI.
Using Configuration Files to Control PowerShell Scripts, Part 1: The Basics

Learn how to use JSON configuration files to make PowerShell scripts more dynamic, flexible and user-friendly.
Exchange Online Receiving Enhanced Message Trace

Microsoft has announced the public preview of its enhanced Message Trace feature in the Exchange admin center (EAC) for Exchange Online.
Major Microsoft Multifactor Authentication Vulnerability Revealed

A vulnerability in Microsoft’s multifactor authentication (MFA) system has been uncovered by cybersecurity firm Oasis Security, allowing attackers to bypass security measures and access sensitive data across services including Outlook, OneDrive, Teams and Azure.