Search Support

Avoid support scams. We will never ask you to call or text a phone number or share personal information. Please report suspicious activity using the “Report Abuse” option.

Learn More

How to make Firefox accept a third-party cookie used for authentication by a Java web application?

  • 4 odgovori
  • 1 ima ovaj problem
  • 19 views
  • Posljednji odgovor poslao cor-el

more options

Hi,

I am a developer currently working on an open-source solution called GeoNetwork (https://github.com/geonetwork/core-geonetwork/). This application has a Java backend that uses a JSESSIONID cookie to track user sessions. One instance of the application can be accessed anonymously here: https://sextant.ifremer.fr/Donnees/Catalogue

The session cookie is set on the first request to the backend with the following parameters:

Domain: "sextant.ifremer.fr" expirationDate: "Session" HostOnly: true HttpOnly: true SameSite: "None" Secure: true

This application theoretically allows login in from a different origin. For example from https://www.milieumarinfrance.fr/Acces-aux-donnees/Catalogue, which under the hood points to the same backend. We noticed recently that when accessing the application from a different origin in Firefox, the network requests aimed at the "sextant.ifremer.fr" host *do not carry any existing session cookie*, thus rendering authenticated access impossible.

The existing session cookie is correctly used when I add an "allow" exception for the sextant.ifremer.fr origin in the cookies settings of Firefox (see attached screenshot in French). So I figure that it's Firefox that decides not to use any existing cookie when on this origin.

Is there any way to indicate to Firefox that this cookie is legitimate and that it is needed for essential functionalities, without relying on the user allowing the cookie explicitly?

Thanks a lot in advance!

Hi, I am a developer currently working on an open-source solution called GeoNetwork (https://github.com/geonetwork/core-geonetwork/). This application has a Java backend that uses a JSESSIONID cookie to track user sessions. One instance of the application can be accessed anonymously here: https://sextant.ifremer.fr/Donnees/Catalogue The session cookie is set on the first request to the backend with the following parameters: Domain: "sextant.ifremer.fr" expirationDate: "Session" HostOnly: true HttpOnly: true SameSite: "None" Secure: true This application theoretically allows login in from a different origin. For example from https://www.milieumarinfrance.fr/Acces-aux-donnees/Catalogue, which under the hood points to the same backend. We noticed recently that when accessing the application from a different origin in Firefox, the network requests aimed at the "sextant.ifremer.fr" host *do not carry any existing session cookie*, thus rendering authenticated access impossible. The existing session cookie is correctly used when I add an "allow" exception for the sextant.ifremer.fr origin in the cookies settings of Firefox (see attached screenshot in French). So I figure that it's Firefox that decides not to use any existing cookie when on this origin. Is there any way to indicate to Firefox that this cookie is legitimate and that it is needed for essential functionalities, without relying on the user allowing the cookie explicitly? Thanks a lot in advance!
Priloženi snimci ekrana

All Replies (4)

more options

Firefox "cookie Jar" thing has broken a lot of stuff for a lot of people, try turning it off in your settings and see if that fixes it.

Helpful?

more options

Helpful?

more options

Thanks cor-el, using the FAQ I could confirm that the issue is indeed related to Total Cookie Protection. Disabling it makes the issue go away.

Should I just create an issue on the Mozilla bug tracker and ask them to somehow "approve" the sextant.ifremer.fr origin? Thanks :)

Helpful?

more options

You can always give this a try and create a bug report to make them aware that there issues with your website and get advice about the best way to proceed. Firefox will notice in some cases that cookies from some from some third-party servers are essential and allow them.

Helpful?

Postavite pitanje

You must log in to your account to reply to posts. Please start a new question, if you do not have an account yet.