-
Notifications
You must be signed in to change notification settings - Fork 3
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
chore: disable ARRAffinity cookie #142
Comments
This cookie exists on the JS returned by KMW's API calls. If one visits one of the links produced for an API query (example), then enters In this context, that cookie may be considered "same-site". Chrome raises no issues here. However, for KMW installations that aren't within the KMW itself doesn't need that cookie... so we can probably go with same-site only. My current question - where is that cookie coming from? |
Inspecting via the Headers tab... Based on this: Lines 61 to 82 in 5aeb41b
it would appear that this file would be the correct place to look. Except that a search op on that file doesn't bring up anything for either "header" or "_ga". Then again, this is in the request header... from a raw query to that API endpoint. Just to be safe, I decided to load up the link in a completely fresh browser that had never followed it. (Opera, since I very recently downloaded it for something else.) No cookie was reported there... so maybe the original cause has already been fixed? That'd imply that the reason I still see the issues in Chrome is due to a 'never time out' setting when the cookie had been in active use. Except that then visiting one of KMW's testing pages, within that browser, shows that there is one being set against Actually, upon re-examination, I can find that header information from the testing page (instead of through the direct query call), and there I see: A couple of web searches later, and... https://stackoverflow.com/questions/50741024/does-arraffinity-cookie-always-set-on-azure-web-application Looks like it's something being set by our hosting servers. |
Also worth notice: Chrome is now actively blocking these cookies for KMW's host page... and everything's working fine, without any targeted changes from us. That said, anyone making API calls against our servers will likely be seeing similar issue reports. |
|
We do not use ARR at present -- and are completely stateless should be able to disable it per https://azure.microsoft.com/en-us/blog/disabling-arrs-instance-affinity-in-windows-azure-web-sites/ We can move this issue to api.keyman.com to be addressed there. |
I no longer see this occurring. It would be helpful to have a repro for these kinds of issues -- e.g. a link to the site where this was happening. |
I believe this was happening for in-repo pages under |
Recently saw this message in the developer console during testing:
We'll probably need to make some adjustments corresponding to this.
The text was updated successfully, but these errors were encountered: