Use SameSite none for session token when embedded into iframe #15439
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
tsteur
added
not-in-changelog
|
Can this be tested on Chrome 80 with the "Samesite by default cookies" and "Cookies without Samesite must be secure" flags set as enabled? That is what the default behavior will be when Chrome 80 is launched on Feb 4 and if a cookie is set with SameSite=none without being marked as Secure, it will be blocked. |
|
Works for me after loading on demo2, both w/ and without the settings mentioned by @dm577 |
sgiehl
added a commit
that referenced
this pull request
Feb 11, 2020
* Updates search engine and social definitions (#15384) * updates device detector to latest release (#15388) * updates device detector to latest release * updates tests * translation update (#15389) * Fix Could not get the lock for ID, when creating a site (#15401) * Lock key start * do not empty key lock Co-authored-by: Thomas Steur <tsteur@users.noreply.github.com> * 3.13.1 * submodule updates * Use correct name in update available message (#15423) * Fix removing user capabilities (#15422) * Order of implode() args, avoid E_NOTICE in PHP7.4 (#15428) * Fixes possible php warning in visitor log (#15442) * silence is_executable call (#15446) * Make sure geolocation admin experience is consistent if user is not using GeoIp2 plugin. (#15447) * Fix referrers test. (#15448) * Ensure to close visitor popover correctly (#15443) * Fixes possible warning (#15453) * Forward instance_id from local config when reseting config during tests. (#15445) * Add event that allows plugins to disable archiving for certain periods/sites if they want. (#15457) * Add event that allows plugins to disable archiving for certain periods/sites if they want. * apply review feedback * Fix possible warning for columns without index (#15467) * Day range archiving issue (#15462) * Improve lock ID check for max length (#15407) Better patch for #15401 which was merged last minute... This way it always works even when someone calls `acquireLock` directly instead of `execute` Pushing this for now into 3.x-dev but can also put it into 4.x-dev directly but then there might be merge conflicts when merging 3.x-dev into 4.x-dev * Use SameSite none for session token when embedded into iframe (#15439) * Make sure tracking works in IE9 and lower (#15480) * Mention Joomla install FAQ (#15481) * Make sparklines work when mbstring extension is not installed (#15489) 1) Too few arguments to function mb_strtolower(), 1 passed in matomo/vendor/davaxi/sparkline/src/Sparkline/StyleTrait.php on line 129 and exactly 2 expected 2) mb_strlen is not defined * update screenshots (#15488) * 3.13.2-rc1 * Use safemode when running CLI commands (#15472) * update icons submodule (#15490) * update icons submodule * update UI tests * Fix possible undefined index notice (#15502) * Use latest davaxi/sparkline release (#15464) * translation update * submodule updates * Fix deprecation notice (#15530) see #15467 (comment) * 3.13.2-rc2 * update cache component (#15536) * fixes copy dashboard to user for more than 100 users (#15538) cherry picking #15424 to fix #15420 in 3.x-dev * Add missing return statement. (#15539) * 3.13.2 * update tests * update tests Co-authored-by: Matthieu Aubry <mattab@users.noreply.github.com> Co-authored-by: Thomas Steur <tsteur@users.noreply.github.com> Co-authored-by: Peter Upfold <pgithub@upfold.org.uk> Co-authored-by: diosmosis <diosmosis@users.noreply.github.com> Co-authored-by: Lukas Winkler <github@lw1.at>
jonasgrilleres
pushed a commit
to 1024pix/pix-analytics
that referenced
this pull request
Sep 22, 2020
jbuget
pushed a commit
to 1024pix/pix-analytics
that referenced
this pull request
Sep 26, 2020
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
fix #15414
Worked for me after enabling embed framed pages. It was setting the
Noneas SameSite though instead ofLaxand I was able to view reports within the frame etc.Used this: