The first thing is that Domino authentication cookies needs to be secured so you can’t hijack the content. This can be performed using the httponly and secure attributes.
Secondly we might need a way to add the samesite attribute to the cookies if we get problems with the new settings in Chrome. The same site settings is to block third party cookies that is used for advertising but in Domino this could give you problems if your applications is bouncing between domains. How to achieve this.
Server setting, no the Domino server doesn’t have this setting.
Vote for the Same site ideas on Domino ideas, UPDATE 2022 your votes made a difference this is now in Domino 12
Javascript, no that isn’t an option because the settings added removes control from javascript.
But using XPages we have no problem reading and set the cookies again with the correct attributes.
I’ve added this to the after page load event, you need to add this code for all Domino Related cookies that your setup use. Like LTPAToken, SessionID or DomAuthSessId
var c:javax.servlet.http.Cookie = cookie.get("DomAuthSessId")
var response=facesContext.getExternalContext().getResponse();
if(c){
if(c.getSecure()==false){
response.addHeader("Set-Cookie","DomAuthSessId="+c.getValue()+"; Path=/; Secure; HttpOnly; SameSite=None");
}
}This changes the cookies after you have done a login but it will not help if the cookies is removed when you do a login.
Fredrik, I have been asking for Samesite cookies for a long time. It is frustrating.
The problems that could come from this hasn’t been checked enough. I’m surprised there isn’t more problems on sites.
Hi Fredrik
Wich version of notes/domino have you tried? It’s useful in 9.x?
Thanks
it should work on version 9.01, 10 and 11
Add this to the “I can’t believe it’s not in Domino” list. Like MFA/2FA.
I have implemented Twilio for 2FA for my xpages site. not too dificult.
Fredrik,
The only problem is this would not work for other design elements like agents and file resources. This has been requested for a long time and it is still not in Domino 11.0.1
It works if you sends the user to an xpage and after that redirect to the file resource or agent.
That would require re-architecting everything. Most likely we will have to put Nginx in front of Domino again.
This only works after reloading the webpage. Is there a way to load it when the page loads the first time?
If the xpage is the first thing loaded after the login, then cookies will be set directly without a reload
There’s no login page. It’s the first page to load and doesn’t appear to have the SessionID secure until I refresh the same page.
Thanks for the reply. There’s no login page. It’s the first page to load.
Hello Fredrik –
Above you mention: “This can be performed using the httponly and secure attributes.” Can the secure attribute be set server wide? I set it with LTPA_ADD_SECURE_TAG=1 in the notes.ini for SSO, but still do have some SESSIONID without the secure attribute that gets flagged in burb scans. My apologies if the point of your post is that there is no server wide setting. Hoping that was specific to Same-Site. Thanks.