I'm managing several e-commerce websites, they are all custom build and they all accept credit card payments via bank redirection (website redirects the client to bank's payment page, bank redirects client back to site after payment has been processed).
Once Chrome 80 was released, I noticed a common trend among all e-commerce websites, when the user has paid and is redirected from the bank back to the e-commerce site, all session cookies are missing. Thus the client is not recognized as the client who initiated the payment.
I'll try to illustrate the problem:
- example.tld - user receives a session cookie
- example.tld - user logs in with a valid email address
- example.tld - user places order
- example.tld - redirect user to mybank.tld
- mybank.tld - user enter cc details, payment is successful
- mybank.tld - redirect user to example.tld
- example.tld - unknown user, no cookies! redirect user to error page
This problem ONLY happens with Chrome 80, all other browsers work fine (Firefox, Safari, Edge, mobile browsers like Samsung Internet, etc). Older versions of Chrome also work fine (<=79).
This problem happens in ALL the e-commerce websites that I manage, the only consistent thing between them is Chrome 80.
Of course all e-commerce sites are PCI certified, use TLSv1.2 and the session cookie is defined with "domain", "secure" (true) and "httpOnly" (true) parameters set. Expires is set to "Session".
Is this some kind of new security feature that clears all current sessions/cookies when Chrome detects visits to a bank?
PS: my issue is not related to the SameSite problems others have, because I am not using crosssite scripting, iframes or anything like that.