Configuration support for SameSite cookie attribute
TheSameSite
attribute indicates the browser whether the cookie can be used for cross-site context or only for same-site context. If an application intends to be accessed in the cross-site context then it can do so only via the HTTPS connection. For details, see RFC6265.
Until Feb 2020, theSameSite
attribute was not explicitly set in the Citrix ADC appliance. The browser took the default value (None). The non-setting ofSameSite
attribute did not impact the Citrix Gateway and Citrix ADC AAA deployments.
With certain browsers upgrade, such as Google Chrome 80, there is a change in the default cross-domain behavior of cookies. TheSameSite
attribute can be set to one of the following values. Default value for Google Chrome is set to Lax. For certain version of other browsers, the default value forSameSite
attribute might still be set to None.
- None: Indicates the browser to use the cookie in cross-site context only on secure connections.
- Lax: Indicates the browser to use the cookie for requests on the same-site context. In the cross-site context, only safe HTTP methods like GET request can use the cookie.
- Strict: Use the cookie only in the same site context.
If there is noSameSite
attribute in the cookie, the Google Chrome assumes the functionality ofSameSite
= Lax. As a result, for deployments within an iframe with cross-site context that require cookies to be inserted by the browser, Google Chrome does not share cross site cookies. As a result, the iframe within the website might not load.
SameSite
cookie attribute
Configure theA new cookie attribute namedSameSite
is added to the VPN and Citrix ADC AAA virtual servers. This attribute can be set at the global level and at the virtual server level.
To configureSameSite
attribute, you must perform the following:
- Set the
SameSite
attribute for the virtual server - Bind cookies to the
patset
(if the browser drops cross-site cookies are dropped by the browser)
Setting theSameSite
attribute by using the CLI
To set theSameSite
attribute at the virtual server level, use the following commands.
set vpn vserver VP1 -SameSite [ STRICT | LAX | None ] set aaa vserver VP1 -SameSite [ STRICT | LAX | None ]
To set theSameSite
attribute at the global level, use the following commands.
set vpn param VP1 -SameSite [ STRICT | LAX | None ] set aaa param VP1 -SameSite [ STRICT | LAX | None ]
Note: The virtual server level setting takes preference over the global level setting. Citrix recommends setting theSameSite
cookie attribute at the virtual server level.
Binding cookies to thepatset
by using the CLI
If the browser drops cross-site cookies, you can bind that cookie string to the existingns_cookies_SameSite patset
so that theSameSite
attribute is added to the cookie.
Example:
bind patset ns_cookies_SameSite "NSC_TASS" bind patset ns_cookies_SameSite "NSC_TMAS"
Setting the SameSite attribute by using the GUI
To set theSameSite
attribute at the virtual server level:
- Navigate toCitrix Gateway > Virtual Servers.
- Select a virtual server and clickEdit.
Select the edit icon in theBasic Settingssection and clickMore.
InSameSite, select the option as required.
To set theSameSite
attribute at the global level:
- Navigate toCitrix Gateway > Global Settings > Change Global Settings.
- Click theSecuritytab.
In
SameSite
, select the option as required.