Okta, Chrome 80, and Cookies

[Dan McClintock]

Has Atlassian published anything on whether their site will be compliant with how Chrome will be handling cross-site cookies with Chrome 80 is released in February?

Okta sent out an email last week about the change and Atlassian is listed as currently not being compatible with the new cookie format which would prevent users from having Okta do SSO to our Atlassian products.

[Daniel Eads · Accepted solution]

Hi Dan,

Thanks for reaching out - it's great that you're on the ball with keeping up with the CSRF changes coming to Chrome. Our team is testing out some changes that will address Chrome's new defaults, although we haven't published anything to the effect on our public site. If you test today (as Okta has recently done), you may find that our production site doesn't look like it will handle the change in Chrome gracefully. But rest assured, our team is addressing it and we'll be ready for February.

Cheers,
Daniel | Atlassian Support

[waynes888]

Hi, It's February, chrome 80 is being distributed and now Jira no longer works on chrome 80. I have tried the workarounds to disable SameSite by default cookies but no luck.

Errors with following message when trying to login:

Oops, you've made a malformed request.

Often, clearing your browsers cache and restarting your browser will solve this problem.
If that doesn't work, please contact support.

Chrome flag settings:

SameSite by default cookies - disabled         

Enable removing SameSite=None cookies - disabled            

Cookies without SameSite must be secure - disabled 

Enable improved cookie controls UI in incognito mode - disabled            

Enable improved UI for third-party cookie blocking - disabled

Tried everything  on Chrome including clearing cache/cookies, restarting, etc,  but the only solution is to use Firefox.

[Colette Custin]

Any updates on this? 

[Karen Mixon]

Hi! 

Any update on this?

Thanks.

[Daniel Eads]

Hey @Colette Custin and @Karen Mixon 

Per the Okta tests, everything is all set on the Atlassian end:

Atlassian Cloud

January 2020

Success

Cheers,
Daniel

[waynes888]

Yep, doesn't work in real life.