Same Site Cookie Support for Adobe Experience Manager as a Cloud Service same-site-cookie-support-for-adobe-experience-manager-as-a-cloud-service
Since version 80, Chrome, and later Safari, introduced a new model for cookie security. This mode is designed to introduce security controls around availability of cookies to third-party sites, through a setting called SameSite. For more detailed information, see web.dev - SameSite cookies explained.
The default value of this setting (SameSite=Lax) might cause authentication between AEM instances or services to not work. This is because the domains or URL structures of these services might not fall under the constraints of this cookie policy.
To get around this, set the SameSite cookie attribute to None for the login token.
SameSite=None setting is only applied if the protocol is secure (HTTPS).WARN com.day.crx.security.token.TokenCookie Skip 'SameSite=None'You can add the setting by following the below steps:
- Install a version of the AEM SDK Quickstart locally
- Go to the Web Console at
http://serveraddress:serverport/system/console/configMgr - Search for and click the Adobe Granite Token Authentication Handler
- Set the SameSite attribute for the login-token cookie to
None, as shown in the image below
- Click Save
- Generate the JSON format configurations for this particular setting by following the steps outlined in Generating OSGi Configurations using the AEM SDK Quickstart
- Apply the settings by following the steps in the Cloud Manager API Format for Setting Properties OSGi documentation.
After this setting is updated and users are logged off and logged on again, login-token cookies have the None attribute set and is included in cross-site requests.