Question
Macquarie
AU
Last activity: 8 Mar 2022 5:13 EST
Pega Mashup not loaded in salesforce, having samesite cookie issue
We are facing an issue around the SameSite Cookies. Have configured the Cross-Site Request Forgery settings correctly but we are not able to load the Pega mashup inside the Salesforce Apex component.
With the recent changes in chrome browser , the samesite attributes for the cookies have been defaulted to Lax and hence its preventing Pega from being loaded with SSO.
Standalone Pega SSO URL works correctly.
Also, the mashup loads in IE correctly, facing issues in chrome.
Has anyone faced any similar issue and applied any work around to fix it ?
KBR
IN
@AdityaK2715 Even I am having the same issue, If pega is not replying what is the workaround it's pathetic.
Did you got the solution.
Updated: 8 Mar 2022 5:13 EST
Pegasystems Inc.
DE
@AdityaK2715 Can you clarify how you "Have configured the Cross-Site Request Forgery settings correctly"?
If Chrome treats the SameSite cookie setting as Lax that indicates that Pega is not configured to set the SameSite option on the PegaRules cookie to 'None'.
To configure this you can either set the according DSS security/csrf/samesitecookieattributevalue with value none directly (see https://docs-previous.pega.com/user-experience/85/corb-error-chrome-80-samesite-cookies).
Alternatively you can go through the CSRF protection landing page (https://docs-previous.pega.com/security/84/enabling-and-configuring-cross-site-request-forgery-settings) and set the Samesite Options to None there.