Embeded comments, Samesite cookie issue

icestormz

Hi so i embeded the universal comments on another site, i did everything correct and could not get the signed in user to show that the user was signed in and can comment, so i disabled the Same site settings in the chrome flags and it started working, problem is the cookies that identify the logged in user is there but the samesite column when insepecting the cookie is blank therefor browser now mark them as Samesite=LAX which will prevent an iframe from reading that cookie and allow vanilla from showing that the user is logged in

i need a way to either modify the core and add that cookie perameter so that it sets the Samesite = none

reference

https://www.chromium.org/updates/same-site

Bleistivt

You will have to add the domain where the forum is embedded to the trusted domains list in your dashboard (/settings/security).

icestormz

https://open.vanillaforums.com/discussion/comment/261869#Comment_261869

i did do that, this allow the frame to load on an external site but dose not resolve the cookie issue which is blocked by chrome because the SameSite information in the cookies is not set

Bleistivt

This feature will be in the next open source release:

https://github.com/vanilla/vanilla/issues/10569

In the meantime if you are on PHP 7.3 you can change line in library/core/functions.compatibility.php line 604:

setcookie($name, $value, ["expires" => $expire, "path" => $path, "domain" => $domain, "secure" => $secure, "httponly" => $httponly, "samesite" => "None"]);

icestormz

https://open.vanillaforums.com/discussion/comment/261879#Comment_261879

Awesome thank you looking forward to this fix, i will modify the line you have suggested

icestormz

https://open.vanillaforums.com/discussion/comment/261879#Comment_261879

Hi has this been fixed in 4.0 RC1 release? i am still not able to see the user logged in when viewing from a iframe

Bleistivt

@icestormz Yes, this has been fixed, however the new cookie functionality requires a secure context for SameSite=None cookies.

This means you have to enable HTTPS and set $Configuration['Garden']['ForceSSL'] = true; in your config.