Bug
When a secured ArcGIS Online web map, application or dashboard is embedded in a website with a different domain, and the user authenticates with ArcGIS Online credentials to access the website, Chrome 80 SameSite cookie updates cause the embedded application to prompt for credentials instead of passing the cookie cross-domain to authenticate the signed-in user.
| Bug ID Number | BUG-000129800 |
|---|---|
| Submitted | April 1, 2020 |
| Last Modified | June 5, 2024 |
| Applies to | ArcGIS Online |
| Version found | 8.1 |
| Operating System | Windows OS |
| Operating System Version | 10.0 |
| Status | Duplicate |
Additional Information
This is a duplicate of BUG-000131669. This issue is not reproducible if the dashboard, map and layers are all shared with the public. If they are only shared with the organization, a login prompt is expected.Workaround
This workaround may not be acceptable to end users as it requires changing Google Chrome to outdated security settings, but it works once Google Chrome updates to enforce the SameSite cookie changes.
- Go to chrome://Flags.
- Change the 'SameSite by default cookies' setting to 'Disabled'.
- Change the 'Cookies without SameSite must be secure' setting to 'Disabled'.
Steps to Reproduce
Bug ID: BUG-000129800
Software:
- ArcGIS Online
Get notified when the status of a bug changes
Discover more on this topic
Search for related information
Find training related to this topic
Explore ideas and give feedback
Get help from ArcGIS experts
Download the Esri Support App