How do I change the Sitecore Analytics cookie to be SameSite=None?

Question

With the default security changes in browsers, third party cookies are getting blocked. Sitecore's SC_ANALYTICS_GLOBAL_COOKIE doesn't seem to have a SameSite property in it so it is being treated as SameSite=LAX and therefore being blocked in third-party scenarios (like when I put some content from Sitecore in an iFrame on another site). This means I am not getting the analytics of those views stored and I cannot personalize that content based on their previous visits, so the visitor is always being treated as "new".

Can I change the analytics cookie to be SameSite=None so it will not be blocked?

Answer 1

Change all cookies to SameSite=None

A new KB article for SameSite with Federated Authentication is now available. In this article, one of the changes it suggests to make allows for ALL generated cookies to be set to SameSite=None.

Configure the default values of cookies in the <system.web> section of the web.config file as follows:

<httpCookies sameSite="None" requireSSL="true" />

Change SC_ANALYTICS_GLOBAL_COOKIE only

In order to change ONLY the analytics cookie you can make a pipeline change with a custom processor. Some notes:

1. This will only work if your site runs on HTTPS because otherwise the cookie will be rejected.
2. The visitor needs to visit the Sitecore site FIRST in order to get the new cookie. This is critical, so you want to make sure you are directing flow somehow through your Sitecore instance directly so that the cookie is created correctly, and then allowing visitors to go elsewhere to other 3rd party applications.

Here is a sample processor that the team here has been trying out:

namespace CustomProcessor
{
    public class AdjustAnalyticsGlobalCookieSameSite
    {
        private const string AnalyticsGlobalCookieName = "SC_ANALYTICS_GLOBAL_COOKIE";

        public void Process(PipelineArgs args)
        {
            var httpResponse = HttpContext.Current?.Response;
            if (httpResponse != null && httpResponse.Cookies.AllKeys.Contains(AnalyticsGlobalCookieName))
            {
                var analyticsCookie = httpResponse.Cookies.Get(AnalyticsGlobalCookieName);
                analyticsCookie.SameSite = SameSiteMode.None;
                analyticsCookie.Secure = true;
            }
        }
    }
}

To get this to run when content is delivered by Sitecore, you’ll need to patch your code into the analytics pipeline as the first processor so that it runs first and sets the cookie correctly:

<configuration xmlns:patch="http://www.sitecore.net/xmlconfig/"
    xmlns:set="http://www.sitecore.net/xmlconfig/set/"
    xmlns:role="http://www.sitecore.net/xmlconfig/role/">

    <sitecore role:require="Standalone or ContentDelivery or ContentManagement">
        <pipelines>
            <endAnalytics>
               <processor type="CustomProcessor.AdjustAnalyticsGlobalCookieSameSite, CustomProcessor" patch:before="processor[@type='Sitecore.Analytics.Pipelines.EndAnalytics.CheckPreconditions, Sitecore.Analytics']"/>
          </endAnalytics>
        </pipelines>
    </sitecore>
</configuration>

References

1. How do the SameSite cookie changes affect Sitecore installations? (Blog, Jason St-Cyr)
2. Sitecore Knowledge Base article on SameSite support
3. Reject insecure SameSite=None cookies (Feature article, Chrome Platform Status)
4. SameSite Cookie Changes in February 2020: What You Need to Know (Chromium.org)
5. SameSite Frequently Asked Questions (FAQ) (Chromium.org)
6. SameSite cookies explained (Web.dev)
7. Cross-site Request Forgery (Wikipedia.org)