1622379 - Payments in redsys (iberia.com, tons of spanish websites...) are broken due to sameSite=lax change

Status: RESOLVED WORKSFORME

(Core :: Networking: Cookies, defect, P2)

Description

[Emilio Cobos Álvarez [:emilio]]

When you execute the order, it says "Session expired", and there's an error in the console like:

Cookie “JSESSIONID” has “sameSite” policy set to “lax” because it is missing a “sameSite” attribute, and “sameSite=lax” is the default value for this attribute.

There's a long redirect chain involved:

• https://www.service.indra-netplus.com/frontal/preautorizacionSegura/iniciar.html
• https://sis.redsys.es/sis/realizarPago
• https://threedsecurepa.petafuel.net

Comment 1

[Emilio Cobos Álvarez [:emilio]]

And then back in the reverse direction until https://www.service.indra-netplus.com/frontal/preautorizacionSegura/finalizar.html is hit again.

Comment 2

[Emilio Cobos Álvarez [:emilio]]

I confirmed that toggling the laxByDefault pref back to false fixes the issue.

Comment 3

[Emilio Cobos Álvarez [:emilio]]

STR is trying to book a flight in iberia.com and paying with credit card, fwiw :/

Comment 4

[Daniel Veditz [:dveditz]]

Emilio: since this was filed Chrome also shipped this feature (in October 2020). Has redsys fixed their behavior now?

Comment 5

[Emilio Cobos Álvarez [:emilio]]

I haven't booked a flight in a while... But let's say it's fixed, since I found a testing store someone has for some sort of woocommerce plugin and I could complete the pay flow with a test account / credit card.