News for hackers. Stuff that matters.

A comment on The Difficulties of SAML Single Logout. Parent comment

Re:The Difficulties of SAML Single Logout by mooreds on Tuesday March 16, 2021 @11:11PM (#26486075)
It was last updated in 2017 per the date at the top, but yes, it's an older article.

This post indicates that 3p cookie issues only affect SSO providers without a hostname that lives within the primary websites domains: https://blogs.akamai.com/2020/01/cookies-single-sign-on-and-... (so SaaS offerings without domain masking). Is that your understanding?

Here's an interesting post on the samesite implications: https://www.troyhunt.com/promiscuous-cookies-and-their-impen...

[ Parent | on HN ]
Re:The Difficulties of SAML Single Logout by hirsin on Tuesday March 16, 2021 @11:25PM (#26486154)
Yup, that's precisely it.

We documented the login breaks from Samesite and 3p cookies, but logout was both not particularly a concern for folks (I've gotten about three inquiries in two years), and pointless to document tombstoning patterns for Samesite since ITP would break those anyway.

https://docs.microsoft.com/en-us/azure/active-directory/deve...

[ Parent | on HN ]
Re:The Difficulties of SAML Single Logout by alfu on Wednesday March 17, 2021 @02:57AM (#26487448)
Is the conclusion to just use use SameSite=None?

I did some research while back and found that shibboleth supports local storage for sessions [0], unfortunately the IdP+SP I'm using do not support such a thing.

[0] https://wiki.shibboleth.net/confluence/display/DEV/IdP+SameS...

[ Parent | on HN ]