Safari 上出现无限 SSO 重定向

支持 SSO
1

在使用多个启用了需要登录并采用 SSO 的 Discourse 实例时，我们在 iOS 的 Safari 浏览器上遇到了登录时无限重定向的问题。具体表现如下：

  1. 用户在 Discourse 或 SSO 主站点均未登录。
  2. 用户访问 Discourse 实例。
  3. Discourse 重定向至 SSO 页面。
  4. SSO 页面提示输入凭据。用户完成登录。
  5. 用户陷入 SSO 主站点与 Discourse 之间的重定向循环，直到 Safari 放弃连接。
  6. 如果用户随后手动再次访问 Discourse，则已处于登录状态。

我在桌面版 Chrome 浏览器上无法复现此行为。

当客户端处于重定向循环时，会生成多条“已启动 SSO 进程”和“用户已登录”的日志条目，这表明 SSO 流程看似成功，但在完成 SSO 后，Discourse 却将用户重定向到了另一个 SSO 登录页面，而非起始页面。

此问题也影响此前 SSO 运行正常的旧实例，因此我认为这不是 Discourse 配置的问题。

有人知道可能是什么问题吗？

2

Any ideas on this @sam?

3

I have seen this on sites that have the setting same site cookies set to Strict, if it is already on Lax recommend attempting to disable and see if it works around the Safari bug.

4

Maybe the new Safari Tech Preview from today will fix it:

Fixed Same-Site Lax cookies to be sent with cross-site redirect from a client-initiated load (r241918)

5

You are :100:% correct. It was on Lax, the default. Changing it to Disabled fixed the issue immediately. (I assume this is a defense-in-depth thing, on top of your usual CSRF protections, so disabling it is not overly terrible for security?)

Let’s hope for the best!

Thank you for your help!

I rate you :star2::star2::star2::star2::star2::mage::mage: (five stars plus wizarding level two)!

6

:man_facepalming: I’ve spent a very long time figuring out a similar issue was caused by this samsite=lax behaviour:

This fixes my issue - at least on macOS Mojave - so I assume it fixes it on iOS too. Thanks!

I’d also like to know people’s opinions on this.

What with this being the Mozilla Discourse and all, we don’t have a huge amount of traffic from Safari, so don’t want to make ourselves vulnerable to CSRF attacks for something which will benefit a very small proportion of our users.