Set SameSite attribute to strict when RP and OP are in the same site

[OlivierBOEL]

Hello,

Just wondering whether the SameSite attribute of state & session cookies is set to Strict when RP and OP are in the same site.
If so, it it automatic or configurable?

Thanks,

Olivier

[zandbelt]

see https://github.com/zmartzone/mod_auth_openidc/blob/v2.4.9.4/auth_openidc.conf#L499-L511

[OlivierBOEL]

Hi, Hans,

Thanks for the link but I don't see how to force SameSite=Strict in all cases (when RP and OP are in the same site, of course).
Could you please clarify?

Thanks,

Olivier

[zandbelt]

use SetEnvIf User-Agent ".*" OIDC_SET_COOKIE_APPEND="; Samesite=Strict"

[OlivierBOEL]

Perffect! Thanks!