Are You Affected by the Third-Party Cookie Deprecation?
As you may already be aware, browser manufacturers are ending support for third-party cookies. A prominent example is Google Chrome’s deprecation of third-party cookies. We are working to ensure that your SAP solutions continue to function with no or minimal potential change in user experience and your application code. The good news is that now is the perfect time to plan for any future changes you need to make once third-party cookies are deprecated.
Web applications can embed other applications in iFrames. This architecture enables the user to enjoy a single experience even though they are accessing two different applications, possibly running under different domains. Currently, this architecture relies on third-party cookies to function. The changes proposed by Google for Chrome can potentially break this architecture. If your solutions are not intended to run embedded in iFrames or if or they all run on ondemand.com, or sapcloud.cn, you aren’t affected by this change.
With this blog, we want to make you aware of where we think you should be testing. Other blogs in this blog series will explain how you can test, how to mitigate any problems you find, and finally adopt a solution based on CHIPS or the Storage Access API, for example.
Integrating Content into SAP Build Work Zone
SAP Build Work Zone (both standard edition and advanced edition) is a central entry point solution for BTP responsible for integrating content. Applications that integrate into such a central entry point are likely to be affected by the deprecation of third-party cookies. Besides SAP Build Work Zone, other entry points might be affected, for example:
- SAP SuccessFactors Work Zone
- SAP Cloud Portal Service, Neo Environment
- SAP Cloud Portal Service, Cloud Foundry Environment
Fig 1. Content Providers for SAP Build Work Zone, standard edition
Figure 1 shows the typical content providers supported by SAP Build Work Zone, standard edition. See Integrating Business Content in the documentation.
Content integrated with SAP BTP content providers is not affected by this change. We have taken steps to ensure this content continues to function.
For content from remote content providers or from manual integrations you might need to take action, as outlined in the following. If the content you integrate doesn’t run on ondemand.com, or sapcloud.cn, we recommend you test your solution according to the testing guide that we will be providing shortly. If you encounter any issues, you may need to request an exception from Google for anything running under your custom domains. We, SAP, have made sure to secure exceptions for the most common central entry points hosted on SAP-owned domains: ondemand.com, cloud.sap and sapcloud.cn. Your application can continue to be integrated into those entry points without any need for modification until the exceptions expire on December 27th, 2024. However, we recommend testing the behavior of your application as outlined in the upcoming post in this blog series to prepare for potentially required change after this date.
These exceptions keep your solutions running until a solution that supports CHIPS or Storage Access API is implemented before December 27th, 2024. We will provide details on how to adapt your application in a future blog post.
If your application is integrated into entry points running on other domains, you need to act now and manually adjust your application to make use of the exceptions. A good indicator that your application is explicitly configured to be embedded in an iFrame is if it has a content security policy applied. You can read more on the content security policy or other security guidelines like the x-frame option for content providers.
Integrating Content Outside of SAP BTP
Some more advanced scenarios also require testing. If you are integrated into another application outside of SAP BTP, or if you are reusing SAP BTP content outside of SAP BTP to consume it on different domains, make sure to check whether the integration involves iFrames or cookies . If yes, then your application is likely affected by the third-party cookie deprecation.
Further Information
We have created an SAP Note where we listed our solutions: SAP Note 3409306 - Removal of Third-Party Cookies in Google Chrome and Microsoft Edge Browser. Follow this note to stay up to date.
In a series of upcoming blog posts, we will cover the following topics:
- How to test your solution for breakage.
- How to handle deprecation trial tokens.
- How to prepare your application for the blockage of third-party cookies.
Please watch this space to stay up to date.
- SAP Managed Tags:
