SameSite Cookie Attribute Now Available for EBS 12.2 and EBS 12.1.3

June 29, 2020 2 minute read

Product Management Director

We are pleased to announce an enhancement to Oracle E-Business Suite security whereby the SameSite cookie attribute setting is now available for EBS 12.2 and EBS 12.1.3. Setting the SameSite cookie attribute provides additional protection against cross-site request forgery (CSRF). We highly recommend that you apply the required patches and enable the SameSite cookie attribute for Oracle E-Business Suite.

When enabling the SameSite cookie attribute, be certain to test integrations that are deployed to a domain that is different from the EBS domain. A few examples of integrations that may have a different domain include iProcurement punchout or single sign-on integration with Oracle Access Manager or Identity Cloud Service.

For Oracle E-Business Suite Release 12.2, Patch 29672027:R12.TXK.C delivers context file parameters to enable and configure the SameSite cookie attribute. For the latest requirement and configuration details, refer to the following:

Using Certified HTTP Security Headers in the Oracle E-Business Suite Security Guide Release 12.2

For Oracle E-Business Suite Release 12.1.3, Patch 30185574:R12.FND.B delivers a profile to enable and configure the SameSite cookie attribute. For the latest requirement and configuration details, refer to the following:

Use the SameSite Cookie Attribute in the Secure Configuration Guide for Oracle E-Business Suite Release 12.1, as found in Secure Configuration for Oracle E-Business Suite Release 12.1 (MOS Note 403537.1)

References

FAQ: Oracle E-Business Suite Security (MOS Note 2063486.1)
Identifying the Latest Critical Patch Update for Oracle E-Business Suite Release 12 (MOS Note 248400.1)
Oracle E-Business Suite Security Guide Release 12.2 – Secure Configuration
Secure Configuration for Oracle E-Business Suite Release 12.1 (MOS Note 403537.1)

Elke Phelps

Product Management Director

Elke is a Product Manager in the Oracle E-Business Suite Applications Technology Group. She joined Oracle in 2011 after having been an Oracle customer and Oracle Technologist (Oracle Database Administrator, Oracle Applications DBA, Technical Architect and Technical Manager of an Oracle Applications DBA Team) since 1993. As part of the Oracle E-Business Suite Applications Technology Product Management Team, her scope of responsibility includes security, database certifications and advanced architectures for on-premises and Oracle Cloud deployments. She is a frequent contributor and editor of the Oracle E-Business Suite Technology Blog. Elke is the lead author of the Oracle Applications DBA Field Guide (Apress 2006) and Oracle R12 Applications DBA Field Guide (Coqui Tech and Press 2010). Elke is also the founder of the Oracle Applications User Group (OAUG) E-Business Suite Applications Technology Special Interest Group (SIG) and served as President of the SIG from February 2005 - August 2011. Elke has been a speaker at the Oracle OpenWorld and Collaborate conferences since 2004. Prior to joining Oracle, Elke was designated an Oracle ACE (2007) and Oracle ACE Director (2009). She received the OAUG Oracle Ambassador of the Year award in 2015. Elke has a Computer Science Degree and a Masters of Business Administration from the University of Oklahoma. In her spare time, Elke enjoys traveling especially to Europe, Puerto Rico and the amazing US National Parks. Elke also enjoys hiking, antiquing, gardening and cooking.

SameSite Cookie Attribute Now Available for EBS 12.2 and EBS 12.1.3

Related Articles

Elke Phelps

Product Management Director

Using IMAP and Third-Party Mail Servers with EBS Workflow Notification Mailer

Data Masking Certified for EBS 12.2 and Database 19c with EM 13cR4

SameSite Cookie Attribute Now Available for EBS 12.2 and EBS 12.1.3

Related Articles

Authors

Elke Phelps

Product Management Director

Using IMAP and Third-Party Mail Servers with EBS Workflow Notification Mailer

Data Masking Certified for EBS 12.2 and Database 19c with EM 13cR4