Join the AMA (Ask Me Anything) with the Firefox leadership team to celebrate Firefox 20th anniversary and discuss Firefox’s future on Mozilla Connect. Mark your calendar on Thursday, November 14, 18:00 - 20:00 UTC!

সহায়তা খুঁজুন

Avoid support scams. We will never ask you to call or text a phone number or share personal information. Please report suspicious activity using the “Report Abuse” option.

আরও জানুন

How to make Firefox accept a third-party cookie used for authentication by a Java web application?

  • 4 উত্তরসমূহ
  • 1 এই সমস্যাটি আছে
  • 3 দেখুন
  • শেষ জবাব দ্বারা cor-el

more options

Hi,

I am a developer currently working on an open-source solution called GeoNetwork (https://github.com/geonetwork/core-geonetwork/). This application has a Java backend that uses a JSESSIONID cookie to track user sessions. One instance of the application can be accessed anonymously here: https://sextant.ifremer.fr/Donnees/Catalogue

The session cookie is set on the first request to the backend with the following parameters:

Domain: "sextant.ifremer.fr" expirationDate: "Session" HostOnly: true HttpOnly: true SameSite: "None" Secure: true

This application theoretically allows login in from a different origin. For example from https://www.milieumarinfrance.fr/Acces-aux-donnees/Catalogue, which under the hood points to the same backend. We noticed recently that when accessing the application from a different origin in Firefox, the network requests aimed at the "sextant.ifremer.fr" host *do not carry any existing session cookie*, thus rendering authenticated access impossible.

The existing session cookie is correctly used when I add an "allow" exception for the sextant.ifremer.fr origin in the cookies settings of Firefox (see attached screenshot in French). So I figure that it's Firefox that decides not to use any existing cookie when on this origin.

Is there any way to indicate to Firefox that this cookie is legitimate and that it is needed for essential functionalities, without relying on the user allowing the cookie explicitly?

Thanks a lot in advance!

Hi, I am a developer currently working on an open-source solution called GeoNetwork (https://github.com/geonetwork/core-geonetwork/). This application has a Java backend that uses a JSESSIONID cookie to track user sessions. One instance of the application can be accessed anonymously here: https://sextant.ifremer.fr/Donnees/Catalogue The session cookie is set on the first request to the backend with the following parameters: Domain: "sextant.ifremer.fr" expirationDate: "Session" HostOnly: true HttpOnly: true SameSite: "None" Secure: true This application theoretically allows login in from a different origin. For example from https://www.milieumarinfrance.fr/Acces-aux-donnees/Catalogue, which under the hood points to the same backend. We noticed recently that when accessing the application from a different origin in Firefox, the network requests aimed at the "sextant.ifremer.fr" host *do not carry any existing session cookie*, thus rendering authenticated access impossible. The existing session cookie is correctly used when I add an "allow" exception for the sextant.ifremer.fr origin in the cookies settings of Firefox (see attached screenshot in French). So I figure that it's Firefox that decides not to use any existing cookie when on this origin. Is there any way to indicate to Firefox that this cookie is legitimate and that it is needed for essential functionalities, without relying on the user allowing the cookie explicitly? Thanks a lot in advance!
স্ক্রিনশটসমূহ সংযুক্ত হয়েছে

All Replies (4)

more options

Firefox "cookie Jar" thing has broken a lot of stuff for a lot of people, try turning it off in your settings and see if that fixes it.

more options
more options

Thanks cor-el, using the FAQ I could confirm that the issue is indeed related to Total Cookie Protection. Disabling it makes the issue go away.

Should I just create an issue on the Mozilla bug tracker and ask them to somehow "approve" the sextant.ifremer.fr origin? Thanks :)

more options

You can always give this a try and create a bug report to make them aware that there issues with your website and get advice about the best way to proceed. Firefox will notice in some cases that cookies from some from some third-party servers are essential and allow them.