Configuration support for SameSite cookie attribute
TheSameSiteattribute indicates the browser whether the cookie can be used for cross-site context or only for same-site context. If an application intends to be accessed in the cross-site context then it can do so only via the HTTPS connection. For details, see RFC6265.
Until Feb 2020, theSameSiteattribute was not explicitly set in the Citrix ADC appliance. The browser took the default value (None). The non-setting ofSameSiteattribute did not impact the Citrix Gateway and Citrix ADC AAA deployments.
With certain browsers upgrade, such as Google Chrome 80, there is a change in the default cross-domain behavior of cookies. TheSameSiteattribute can be set to one of the following values. Default value for Google Chrome is set to Lax. For certain version of other browsers, the default value forSameSiteattribute might still be set to None.
- None: Indicates the browser to use the cookie in cross-site context only on secure connections.
- Lax: Indicates the browser to use the cookie for requests on the same-site context. In the cross-site context, only safe HTTP methods like GET request can use the cookie.
- Strict: Use the cookie only in the same site context.
If there is noSameSiteattribute in the cookie, the Google Chrome assumes the functionality ofSameSite= Lax. As a result, for deployments within an iframe with cross-site context that require cookies to be inserted by the browser, Google Chrome does not share cross site cookies. As a result, the iframe within the website might not load.
Configure theSameSitecookie attribute
A new cookie attribute namedSameSiteis added to the VPN and Citrix ADC AAA virtual servers. This attribute can be set at the global level and at the virtual server level.
To configureSameSiteattribute, you must perform the following:
- Set the
SameSiteattribute for the virtual server - Bind cookies to the
patset(if the browser drops cross-site cookies are dropped by the browser)
Setting theSameSiteattribute by using the CLI
To set theSameSiteattribute at the virtual server level, use the following commands.
set vpn vserver VP1 -SameSite [ STRICT | LAX | None ] set aaa vserver VP1 -SameSite [ STRICT | LAX | None ] To set theSameSiteattribute at the global level, use the following commands.
set vpn param VP1 -SameSite [ STRICT | LAX | None ] set aaa param VP1 -SameSite [ STRICT | LAX | None ] Note: The virtual server level setting takes preference over the global level setting. Citrix recommends setting theSameSitecookie attribute at the virtual server level.
Binding cookies to thepatsetby using the CLI
If the browser drops cross-site cookies, you can bind that cookie string to the existingns_cookies_SameSite patsetso that theSameSiteattribute is added to the cookie.
Example:
bind patset ns_cookies_SameSite "NSC_TASS" bind patset ns_cookies_SameSite "NSC_TMAS" Setting the SameSite attribute by using the GUI
To set theSameSiteattribute at the virtual server level:
- Navigate toCitrix Gateway > Virtual Servers.
- Select a virtual server and clickEdit.
Select the edit icon in theBasic Settingssection and clickMore.
![Click More in Basic Settings]()
InSameSite, select the option as required.
![Set `SameSite` check box]()
To set theSameSiteattribute at the global level:
- Navigate toCitrix Gateway > Global Settings > Change Global Settings.
- Click theSecuritytab.
In
SameSite, select the option as required.![Select `SameSite` check box]()
