This article is more than 1 year old
Mozilla warns more Firefox website breakage to come because devs just aren't checking for SameSite snafus
UK govt portal among those borked
Mozilla on Wednesday warned that an ongoing change in the way Firefox handles browser cookies may interfere with websites – and urged web developers to test their code.
The transition, backed by other browser vendors, has to do with the SameSite
attribute, which is used to declare how browsers should handle cookies.
Described in a 2016 specification, the SameSite
attribute allows web apps to state that cookies should not be sent with cross-site requests – requests from a third-party origin (domain). With three possible values – SameSite=None;
SameSite=Lax;
and SameSite=Strict
– it provides a defense against cross-origin information leakage and cross-site request forgery attacks.
At the start of the year, Google said it had begun a gradual rollout of a change to the default behavior of the SameSite
attribute in Chrome 80 and sounded the alarm that some sites might not function properly. The change is simply that if undeclared, Chrome will assume a SameSite
value of Lax
instead of None
.
Since web developers haven't traditionally set this attribute, the change in the default setting was expected to cause problems. The Lax
setting is only a bit more restrictive than None
, but it's enough to prevent some websites from functioning properly.
Google warns devs as it tightens Chrome cookie security: Stuff will break if you're not clued up
READ MOREThe collateral damage proved serious enough that Google temporarily reversed its SameSite
rollout in April due to the initial impact of the coronavirus pandemic. It seemed a bad idea at the time to hinder access to online healthcare resources.
Last month, Google said its SameSite
cookie enforcement in Chrome had resumed and would once again be ramping up. Its SameSite
changes are being activated for Chrome Stable channel users in versions 80 through 84, the latest release, though it's only available for an unspecified subset of users at this point.
Microsoft and Apple both support SameSite
in their browsers but neither has said much about adopting the same default handling of the attribute.
Mozilla meanwhile is moving ahead with its implementation. It activated the revised SameSite
default behavior in Firefox Nightly 75 back in February. And in conjunction with the release of Firefox Beta 79 in June, the safer SameSite
behavior has been activated for 50 per cent of beta users.
"We are changing the default value of the SameSite
attribute for cookies from None
to Lax
," said Mike Conca, group product manager for Firefox Web Technologies at Mozilla, in a blog post. "This will greatly improve security for users. However, some web sites may depend (even unknowingly) on the old default, potentially resulting in breakage for those sites."
Reports of snafus related to SameSite
behavior, in Chrome and Firefox, have been trickling in for months. The latest issue for users of a pre-release version of Firefox (v81 on the Firefox Nightly release channel) is that GOV.UK Verify, a sign-in service for UK residents to access government services, can't process logins properly.
The Register asked the UK's Cabinet Office about this but given the time difference with our San Francisco office we don't expect an immediate response.
Other websites that have broken under the new SameSite
regime include UK mobile provider Three, Analog Devices, and Sony's PlayStation.com, to name a few. Both Chrome and Firefox maintain bug lists to track site breakage.
"There is currently no timeline to ship this feature to the release channel of Firefox," said Conca. "We want to see that the Beta population is not seeing an unacceptable amount of site breakage—indicating most sites have adapted to the new default behavior."
But since there's no clear definition of "breakage," he said, the Firefox team intends to keep an eye on various channels people use to report problems, such as Bugzilla, social media sites, and the like. ®