Configuring Login Persistence Options for External Websites

Print Friendly and PDF Follow

When a user logs into the Aeon web interface, a SessionID is created for that user and stored in a session cookie that will allow the user to remain logged into the Aeon system for the duration of their web session. However, after the recent SameSite cookie changes rolled out by Google Chrome, logged-in Aeon users may experience issues remaining logged into the Aeon system each time a request is submitted from an external website (i.e., from a website outside of the Aeon web pages, such as a library catalog or finding aid) due to the web browser blocking the Aeon session cookie.

Configuring Aeon Session Cookie Persistence Options

The WebCookieSameSite customization key will not set the SameSite property value on session cookies generated by the Atlas Authentication Portal. The Atlas Auth Portal must be updated to v1.3.2 to implement handling for setting the SameSite property on the session cookie. For details, see Atlas Auth Portal 1.3.x Release Configuration.

As of Aeon 5.2, the WebCookieSameSite customization key is used to mitigate these log-in persistence issues by setting a SameSite value on the Aeon session cookie that will prevent the cookie from being blocked by the web browser in certain cases when placing Aeon requests from external websites. This key is located under Web Interface | System in the Aeon Customization Manager and can have three possible values that will persist the Aeon session cookie under three different sets of conditions:

  • None: Sets the SameSite property on the Aeon session cookie to None allowing users to skip the Aeon login screen if the external website has been configured to use HTTPS.

    Note: If the external website is configured to use HTTP, the SameSite cookie property will be overridden for security purposes and set to Lax even if this key is set to None, meaning that users will only skip the Aeon login screen if the external website is hosted under the same domain as the Aeon web pages.
  • Lax: Sets the SameSite property on the Aeon session cookie to Lax allowing users to skip the Aeon login screen only if the external website is under the same domain as the Aeon web pages. 
  • Strict: Sets the SameSite cookie property on the Aeon session cookie to Strict forcing users to log back into Aeon from any external website even if it is under the same domain as the Aeon web pages.
The default value of the WebCookieSameSite key will be set to None, which will allow users to skip the Aeon login screen when requesting from an external website using an HTTPS connection or when requesting from an external website using an HTTP connection that is hosted under the same domain as the Aeon web pages. Due to security reasons, it is not possible to persist the session cookie when placing requests from an external website using an HTTP connection that is under a different domain from your Aeon web pages.

Questions?

If this article didn’t resolve your issue, please contact Atlas Support for assistance:

Contact Support