Chrome blocking Vaadin Cookies - again!

Flow
1

Hi all,

I am not able to load my Vaadin application in Chrome, because it says that cookies are blocked.
However, Cookies are enabled, no extensions are installed, the cache and all cookies are cleared, I hard-reloaded the page, I restarted the application etc. etc.

Basically, I’ve tried every suggestion I could find on Google, but none worked. My Chrome version is 79.0.3945.130 and the problem appeared overnight.

And I should add that this problem only appears in development mode when running on localhost. The application, when deployed on a remote server and running in production mode, works just fine.

2

Yes! Same here! Any news? Please, help us!

3

What is the effect if you use 0.0.0.0 instead of localhost?

4

I had the issue again a couple of days ago with Chrome 85.0.4183.102, but this time I could resolve it by clearing the cookie cache.

5

Syam Pillai:
What is the effect if you use 0.0.0.0 instead of localhost?

Well, let me be more specific. My App is inside Joomla iFrame and in another server (my server app does not have a name, only IP).

Imagine:

Server A running php JOOMLA, ip a.a.a.a, dns ServerA

Server B running my Vaadin App under Tomcat ip b.b.b.b, no dns

in ServerA there is an page with iframe pointing to b.b.b.b/myVaadinApp

I don’t understand where testing 0.0.0.0 would help us…do you?

Thank you anyway!

6

Chrome treats cookies differently when 0.0.0.0 is used instead of localhost. That’s why.

7

Syam Pillai:
Chrome treats cookies differently when 0.0.0.0 is used instead of localhost. That’s why.

Hum…but in my case it won’t help me, right?

Thank You!

8

Your setup is a bit more involved than usual - can you eliminate Joomla and reproduce with Chrome/Vaadin only? If yes, then the next step could be to install your OS and Chrome from scratch on a virtual machine and if that works, then my bet is that somehow your Chrome cookies aren’t properly cleared.

9

This is probably related to the change of Google’s Chrome about SameSite Cookies: https://blog.chromium.org/2020/04/temporarily-rolling-back-samesite.html

10

If that is so, does that mean that something needs to be fixed in the Vaadin framework? Or do I have to change anything in my app?

11

Sorry, my idea was related to the complex setup above with vaadin running inside an iframe. (there it could be solved from e.g. apache adding the missing SameSite attribute if it’s the culprit) This shouldn’t be the case for your setup!