The issue is Chrome 80+ and all other modern browsers, they are updating their cookie policy. The cookie policy is Third-Party not going to access the current browser cookie.
So, We are using any third party plugins like payment gateway, while payment its redirected to their payment gateway only. when come back to our merchant site, merchant site not allowed to use cookie information. Thats why, we are facing that issue.
It Means, Moden browsers SameSite=Lax by default
, If SameSite=Lax by default means, Merchant site not allow to use cookies for third party sites.
So, We have to set SameSite=None; Secure
for the thrid party pages. Then only third party site can assess the session and update the order status.
After searching regarding this issue.
I have found a partial solution from Magento GitHub to update some core code. For my project, I am using the following configuration.
Magento 2.4.1, PHP 7.3 and Apache 2.4
Goto this file Magento\Framework\Stdlib\Cookie\SensitiveCookieMetadata
protected $request;
public function __construct(RequestInterface $request, $metadata = [])
{
if (!isset($metadata[self::KEY_HTTP_ONLY])) {
$metadata[self::KEY_HTTP_ONLY] = true;
}
// PATCH
$this->request = $request;
if (!isset($metadata[self::KEY_SAME_SITE])) {
// $metadata[self::KEY_SAME_SITE] = 'Lax';
$isSecure = $this->getSecure();
$metadata[self::KEY_SAME_SITE] = $isSecure ? 'None' : 'Lax';
}
//~ PATCH
parent::__construct($metadata);
}
For Apache, add below script in .htaccess file located at root directory
<If "%{HTTP_USER_AGENT} =~ /(iPhone; CPU iPhone OS 1[0-2]|iPad; CPU OS 1[0-2]|iPod touch; CPU iPhone OS 1[0-2]|Macintosh; Intel Mac OS X.*Version\x2F1[0-2].*Safari|Macintosh;.*Mac OS X 10_14.* AppleWebKit.*Version\x2F1[0-3].*Safari|(Chrom[^ \x2F]+\x2F(([4-5][0-9])|([6][0-7]))[\.\d]*[ ]))/i">
Header always edit Set-Cookie "^(.*)(;[ ]?SameSite=None|;[ ]?samesite=None)(.*)?$" "$1$3"
</If>
For Nginx, with this code you can define all your application cookies as secure, httponly and/or samesite using proxy_cookie_path (http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_cookie_path)
location / {
# your usual config ...
# hack, set all cookies to secure, httponly and samesite (strict or lax)
proxy_cookie_path / "/; secure; HttpOnly; SameSite=none";
}
For PHP 7.3 and above, set following configuration in php.ini file
session.cookie_samesite = "None"
session.cookie_secure = 1
After that, run that following commands and try it out.
php bin/magento setup:upgrade
php bin/magento setup:di:compile
php bin/magento setup:static-content:deploy -f
php bin/magento indexer:reindex
php bin/magento cache:clean
then, see, Inspect elements
in browser, For that third party pages only you can see SameSite=None; Secure
and all other pages use SameSite=Lax
. Then yor are configuration is right. its will works fine.