Currently, I am authenticating against an OIDC service using Passport.js with the OAuth2Strategy strategy. The issue arises when my application needs to make cross-domain requests to services that require the connect.sid cookie set by Passport. Chrome has announced plans to discontinue support for these requests unless the SameSite attribute of the cookie is set to "Lax".
I am unsure how to adjust this setting since the cookie management is handled internally by Passport. Are there any suggestions or workarounds for this situation? Below is the relevant function call located in the callback route provided to the OIDC service:
passport.authenticate("oauth2", function (err, user, info) {
if (err) {
req.flash('error', err);
res.redirect('/login_error/');
} else if (!user) {
req.flash('error', 'Unable to locate user account.');
res.redirect('/login_error/');
} else {
req.logIn(user, (err) => {
if (err) { return next(err); }
return res.redirect('/user_profile/');
});
}
})(req, res, next);