diff --git a/config-templates/config.php b/config-templates/config.php index 1571fc50e4c5e7c5a5f0f23f3934e9b2fb185686..02acd863854158db3aa0c9caf0b9b93adb349140 100644 --- a/config-templates/config.php +++ b/config-templates/config.php @@ -575,6 +575,13 @@ $config = [ * the RFC6265bis SameSite cookie attribute. If set to null, no SameSite * attribute will be sent. * + * A value of "None" is required to properly support cross-domain POST + * requests which are used by different SAML bindings. Because some older + * browsers do not support this value, the canSetSameSiteNone function + * can be called to only set it for compatible browsers. + * + * You must also set the 'session.cookie.secure' value above to true. + * * Example: * 'session.cookie.samesite' => 'None', */ diff --git a/docs/simplesamlphp-nostate.md b/docs/simplesamlphp-nostate.md index 05d22776b7250c65d0cdd9f019316d3ccb77f33c..4f113a198c59c7fabdee39536c7ff253cd8f6927 100644 --- a/docs/simplesamlphp-nostate.md +++ b/docs/simplesamlphp-nostate.md @@ -112,6 +112,7 @@ assertion via the HTTP-POST binding. To resolve this, you can set the `session.cookie.samesite` attribute in `config.php` to `None`. Starting with SimpleSAMLphp 1.19, the config template contains a way to set this dynamically based on the user's browser support for this attribute. +You also need to enable the `session.cookie.secure` setting. ### A generic problem saving sessions