Product documentation
Citrix Gateway
Current Release 13.0 12.1
View PDF

Configuration support for SameSite cookie attribute

October 5, 2020
Contributed by: 
S C

The SameSite attribute indicates the browser whether the cookie can be used for cross-site context or only for same-site context. Also, if an application intends to be accessed in cross-site context then it can do so only via HTTPS connection. For details, see RFC6265.

Until Feb 2020, the SameSite attribute was not explicitly set in Citrix ADC. The browser took the default value (None). The non-setting of SameSite attribute did not impact the Citrix Gateway and Citrix ADC AAA deployments.

With certain browsers upgrade, such as Google Chrome 80, there is a change in the default cross-domain behavior of cookies. The SameSite attribute can be set to one of the following values. Default value for Google Chrome is set to Lax. For certain version of other browsers, the default value for SameSite attribute might still be set to None.

  • None: Indicates the browser to use cookie in cross-site context only on secure connections.
  • Lax: Indicates the browser to use cookie for requests on the same-site context. In cross-site context, only safe HTTP methods like GET request can use the cookie.
  • Strict: Use the cookie only in the same site context.

If there is no SameSite attribute in the cookie, the Google Chrome assumes the functionality of SameSite = Lax. As a result, for deployments within an iframe with cross-site context that require cookies to be inserted by the browser, Google Chrome does not share cross site cookies. As a result, the iframe within the website might not load.

A new cookie attribute named SameSite is added to the VPN and Citrix ADC AAA virtual servers. This attribute can be set at the global level and at the virtual server level.

To configure SameSite attribute, you must perform the following:

  1. Set the SameSite attribute for the virtual server
  2. Bind cookies to the patset (if the browser drops cross-site cookies are dropped by the browser)

Setting the SameSite attribute by using the CLI

To set the SameSite attribute at the virtual server level, use the following commands.

set vpn vserver VP1 -SameSite  [ STRICT | LAX | None ]
set aaa vserver VP1 -SameSite  [ STRICT | LAX | None ]
<!--NeedCopy-->

To set the SameSite attribute at the global level, use the following commands.

set vpn param VP1 -SameSite  [ STRICT | LAX | None ]
set aaa param VP1 -SameSite  [ STRICT | LAX | None ]
<!--NeedCopy-->

Note: The virtual server level setting takes preference over the global level setting. Citrix recommends setting the SameSite cookie attribute at the virtual server level.

Binding cookies to the patset by using the CLI

If the browser drops cross-site cookies, you can bind that cookie string to the existing ns_cookies_SameSite patset so that the SameSite attribute is added to the cookie.

Example:

bind patset ns_cookies_SameSite "NSC_TASS"
bind patset ns_cookies_SameSite "NSC_TMAS"
<!--NeedCopy-->

Setting the SameSite attribute by using the GUI

To set the SameSite attribute at the virtual server level:

  1. Navigate to Citrix Gateway > Virtual Servers.
  2. Select a virtual server and click Edit.

  3. Select the edit icon in the Basic Settings section and click More.

    Click More in Basic Settings

  4. In SameSite, select the option as required.

    Set SameSite check box

To set the SameSite attribute at the global level:

  1. Navigate to Citrix Gateway > Global Settings > Change Global Settings.
  2. Click the Security tab.

  3. In SameSite, select the option as required.

    Select SameSite check box

Configuration support for SameSite cookie attribute
October 5, 2020
Contributed by: 
S C
October 5, 2020
Contributed by: 
S C

In this article

Site feedback | Privacy and legal terms | Cookie preferences | Consent settings
© 1999- Cloud Software Group, Inc. All rights reserved.