Important Notice: We're experiencing email notification issues. If you've posted a question in the community forums recently, please check your profile manually for responses while we're working to fix this.

On Monday the 3rd of March, around 5pm UTC (9am PT) users may experience a brief period of downtime while one of our underlying services is under maintenance.

Avatar for Username

Kërkoni te Asistenca

Shmangni karremëzime gjoja asistence. S’do t’ju kërkojmë kurrë të bëni një thirrje apo të dërgoni tekst te një numër telefoni, apo të na jepni të dhëna personale. Ju lutemi, raportoni veprimtari të dyshimtë duke përdorur mundësinë “Raportoni Abuzim”.

Mësoni Më Tepër

Kjo rrjedhë është arkivuar. Ju lutemi, bëni një pyetje të re, nëse keni nevojë për ndihmë.

How to make Firefox accept a third-party cookie used for authentication by a Java web application?

  • 4 përgjigje
  • 1 e ka hasur këtë problem
  • 13 parje
  • Përgjigjja më e re nga cor-el

guyot.o
guyot.o
more options

Hi,

I am a developer currently working on an open-source solution called GeoNetwork (https://github.com/geonetwork/core-geonetwork/). This application has a Java backend that uses a JSESSIONID cookie to track user sessions. One instance of the application can be accessed anonymously here: https://sextant.ifremer.fr/Donnees/Catalogue

The session cookie is set on the first request to the backend with the following parameters:

Domain: "sextant.ifremer.fr" expirationDate: "Session" HostOnly: true HttpOnly: true SameSite: "None" Secure: true

This application theoretically allows login in from a different origin. For example from https://www.milieumarinfrance.fr/Acces-aux-donnees/Catalogue, which under the hood points to the same backend. We noticed recently that when accessing the application from a different origin in Firefox, the network requests aimed at the "sextant.ifremer.fr" host *do not carry any existing session cookie*, thus rendering authenticated access impossible.

The existing session cookie is correctly used when I add an "allow" exception for the sextant.ifremer.fr origin in the cookies settings of Firefox (see attached screenshot in French). So I figure that it's Firefox that decides not to use any existing cookie when on this origin.

Is there any way to indicate to Firefox that this cookie is legitimate and that it is needed for essential functionalities, without relying on the user allowing the cookie explicitly?

Thanks a lot in advance!

Hi, I am a developer currently working on an open-source solution called GeoNetwork (https://github.com/geonetwork/core-geonetwork/). This application has a Java backend that uses a JSESSIONID cookie to track user sessions. One instance of the application can be accessed anonymously here: https://sextant.ifremer.fr/Donnees/Catalogue The session cookie is set on the first request to the backend with the following parameters: Domain: "sextant.ifremer.fr" expirationDate: "Session" HostOnly: true HttpOnly: true SameSite: "None" Secure: true This application theoretically allows login in from a different origin. For example from https://www.milieumarinfrance.fr/Acces-aux-donnees/Catalogue, which under the hood points to the same backend. We noticed recently that when accessing the application from a different origin in Firefox, the network requests aimed at the "sextant.ifremer.fr" host *do not carry any existing session cookie*, thus rendering authenticated access impossible. The existing session cookie is correctly used when I add an "allow" exception for the sextant.ifremer.fr origin in the cookies settings of Firefox (see attached screenshot in French). So I figure that it's Firefox that decides not to use any existing cookie when on this origin. Is there any way to indicate to Firefox that this cookie is legitimate and that it is needed for essential functionalities, without relying on the user allowing the cookie explicitly? Thanks a lot in advance!
Foto të bashkëngjitura ekrani

Krejt Përgjigjet (4)

stygian.shift
stygian.shift
more options

Firefox "cookie Jar" thing has broken a lot of stuff for a lot of people, try turning it off in your settings and see if that fixes it.

cor-el
cor-el
  • Top 25 Contributor
  • Moderator
more options

Some reading about the new behavior.

guyot.o
guyot.o I zoti i pyetjes
more options

Thanks cor-el, using the FAQ I could confirm that the issue is indeed related to Total Cookie Protection. Disabling it makes the issue go away.

Should I just create an issue on the Mozilla bug tracker and ask them to somehow "approve" the sextant.ifremer.fr origin? Thanks :)

cor-el
cor-el
  • Top 25 Contributor
  • Moderator
more options

You can always give this a try and create a bug report to make them aware that there issues with your website and get advice about the best way to proceed. Firefox will notice in some cases that cookies from some from some third-party servers are essential and allow them.