KB-2433 Session cookie configured with SameSite=None in Appian Cloud environment using SSO authentication

Symptoms

Penetration testing identified the following session-cookie configuration on an Appian Cloud environment using Okta and Auth0 for authentication:

1. Two Set-Cookie headers are returned in the HTTP response, both for JSESSIONID.
2. The first Set-Cookie header expires the partitioned cookie immediately:

   Set-Cookie: JSESSIONID=<value>; Max-Age=0; Expires=Thu, 01 Jan 1970 00:00:10 GMT; Path=/suite; Secure; HttpOnly; SameSite=None; Partitioned

3. The second Set-Cookie header sets an unpartitioned cookie:

   Set-Cookie: JSESSIONID=<value>; Path=/suite; Secure; HttpOnly; SameSite=None

4. Both cookies use SameSite=None instead of a stricter policy such as Lax or Strict.

Cause

The SameSite=None attribute is required for Appian Cloud environments using third-party SSO authentication providers such as Okta and Auth0. This configuration ensures cross-site authentication flows function correctly. The double Set-Cookie pattern deletes the partitioned cookie before setting the unpartitioned cookie to maintain session state across authentication redirects.

Action

No remediation is required. The observed cookie configuration is expected behavior for Appian Cloud environments using SSO authentication. Appian implements the following CSRF protections to mitigate cross-site request risks:

1. Appian uses the double submit cookie method to prevent CSRF for all state-changing requests.

2. The SameSite attribute is implemented by the Appian Platform as a defense-in-depth measure.

3. The appianCsrfToken and appianMultipartCsrfToken cookies visible in the request provide additional CSRF protection.

Affected Versions

This article applies to all versions of Appian Cloud.

Last Reviewed: November 2026.