SameSite cookies configuration

Products

• Clarity PPM On Premise

Issue/Introduction

How to set SameSite Value to Lax in Clarity?

The SameSite attribute of the Set-Cookie HTTP response header allows you to declare if your cookie should be restricted to a first-party or same-site context.

Note: Standards related to the Cookie SameSite attribute recently changed such that:

• The cookie-sending behavior if SameSite is not specified is SameSite=Lax .Previously the default was that cookies were sent for all requests.
• Cookies with SameSite=None must now also specify the Secure attribute (they require a secure context/HTTPS).

 

Environment

Release : 15.8.1 and higher

Cause

Configuration

Resolution

On Premise Customer Only

• Clarity configured to run as as HTTPS, then Use Secure Session Cookie setting in CSA can be used and no need to set SameSite Value to Lax
• Clarity configured to run as as HTTP and  and the requirement to set SameSite Value to Lax then below steps to be followed
  • Stop all the Clarity Services
  • Login to database using any database client and execute the below update 

    • UPDATE CMN_OPTION_VALUES SET VALUE = 'Lax' WHERE OPTION_ID = (SELECT id FROM CMN_OPTIONS WHERE OPTION_CODE = 'LOGIN_COOKIE_SAMESITE_VALUE')

  • Run the select query to confirm if the value has updated 

    • SELECT Value FROM CMN_OPTION_VALUES  WHERE OPTION_ID = (SELECT id FROM cmn_options WHERE option_code = 'LOGIN_COOKIE_SAMESITE_VALUE')

  • Restart all the clarity service and check the cookie value in the browser trace and it should be coming as Lax.