![Firefox logo](https://assets-prod.sumo.prod.webservices.mozgcp.net/media/uploads/products/2020-04-14-08-36-13-8dda6f.png)
Unable to login after Firefox updated to 96.0
Hi Team,
After updating to Firefox version 96.0, we are unable to login to our application, after pressing login button our login page is getting refreshed. From warnings it looks like a Cookies issue. As 96 version has SameSite:Lax as default but we are setting SameSite:None; secure; but it is not working.
Kindly help us.
Thanks & Regards
被采纳的解决方案
projecthelpdesk2014 said
. . . . we are unable to login to our application
What application are you talking about? Or did you mean a website?
Make sure you are not blocking content.
https://support.mozilla.org/en-US/kb/enhanced-tracking-protection-firefox-desktop also see https://blog.mozilla.org/security/2021/03/23/introducing-smartblock/
https://support.mozilla.org/en-US/kb/smartblock-enhanced-tracking-protection
Diagnose Firefox issues using Troubleshoot(Safe) Mode {web link}
A small dialog should appear. Click Start In Troubleshoot(Safe) Mode (not Refresh). Is the problem still there?
Many site issues can be caused by corrupt cookies or cache.
Warning ! ! This will log you out of sites you're logged in to. You may also lose any settings for that website.
- How to clear the Firefox cache {web link}
所有回复 (3)
选择的解决方案
projecthelpdesk2014 said
. . . . we are unable to login to our application
What application are you talking about? Or did you mean a website?
Make sure you are not blocking content.
https://support.mozilla.org/en-US/kb/enhanced-tracking-protection-firefox-desktop also see https://blog.mozilla.org/security/2021/03/23/introducing-smartblock/
https://support.mozilla.org/en-US/kb/smartblock-enhanced-tracking-protection
Diagnose Firefox issues using Troubleshoot(Safe) Mode {web link}
A small dialog should appear. Click Start In Troubleshoot(Safe) Mode (not Refresh). Is the problem still there?
Many site issues can be caused by corrupt cookies or cache.
Warning ! ! This will log you out of sites you're logged in to. You may also lose any settings for that website.
- How to clear the Firefox cache {web link}
Thank you the prompt response.
We have a Spring based Web application (version 3.1.5.RELEASE) and is running on a Glassfish server. After the recent update of firefox version(96.0) we are unable to login to our website. It is secured site(HTTPS) and a third party service(The third party service is called upon login and is HTTP based.) integration is failing as firefox is restricting access of cross-site cookies as SameSite=Lax.We tried to fix this by setting (in firefox config) network.cookie.sameSite.laxByDefault as false. But it didn't work.
We have also changed our code for setting cookies to HttpServletResponse using: httpServletResponse.setHeader("Set-Cookie: flavor=choco; SameSite=None; Secure", header) to no avail. On inspecting cookie in firefox cookie storage it still shows SameSite:Lax. It seems like this setHeader() is also not working.
What other things we can try to fix this either at browser level or at code level?
projecthelpdesk2014 said
Thank you the prompt response. We have a Spring based Web application (version 3.1.5.RELEASE) and is running on a Glassfish server. After the recent update of firefox version(96.0) we are unable to login to our website. It is secured site(HTTPS) and a third party service(The third party service is called upon login and is HTTP based.) integration is failing as firefox is restricting access of cross-site cookies as SameSite=Lax.We tried to fix this by setting (in firefox config) network.cookie.sameSite.laxByDefault as false. But it didn't work. We have also changed our code for setting cookies to HttpServletResponse using: httpServletResponse.setHeader("Set-Cookie: flavor=choco; SameSite=None; Secure", header) to no avail. On inspecting cookie in firefox cookie storage it still shows SameSite:Lax. It seems like this setHeader() is also not working. What other things we can try to fix this either at browser level or at code level?
Per this note I found -- A Secure cookie is only sent to the server with an encrypted request over the HTTPS protocol. Note that insecure sites (http:) can't set cookies with the Secure directive. ---
I'm not technical but the -- httpServletResponse.setHeader -- Setting WITH SECURE ....was it changed Knowing this fact?