Hello,
All SonarQube Cloud widgets on our Azure DevOps dashboards stopped showing results since a few weeks. They render “Project not found” with a Log in button. Our organization authenticates via enterprise SAML SSO.
Observed behavior
The widget iframe itself loads correctly (304 on /integration/vsts/index.html). Its API calls reach SonarQube Cloud unauthenticated and return 404.
From within the dev.azure.com iframe:
GET https://sonarcloud.io/api/measures/component?component=<project-key>&metricKeys=alert_status&additionalFields=metrics → 404 Not Found
The identical URL pasted into a first-party tab, same browser, same SSO session:
→ 200 OK, alert_status: OK
So the project exists, the key is correct, and the account has permission to read it.
Cause
The JWT-SESSION cookie issued by sonarcloud.io carries no SameSite attribute. Chromium applies its Lax default and withholds the cookie on the widget’s cross-site request. Confirmed in Edge DevTools: on the failing request, the cookie appears only when “show filtered out request cookies” is enabled, and the note states it was blocked because no SameSite value was set, so the default was applied.
The cookie is also unpartitioned (no partition key).
Every widget on the dashboard fails identically.
Question 1 - cookie attributes
Should JWT-SESSION be issued as SameSite=None; Secure, with Partitioned for CHIPS? As it stands, no browser-side configuration can make the widget’s requests authenticated, since the attribute is set by sonarcloud.io.
Question 2 - does this depend on the login path?
Can you confirm whether the SSO login path sets SameSite on JWT-SESSION, and whether it matches what the DevOps-platform login sets?
There is a 2020 report describing the same missing-SameSite cause for the Bitbucket embedded integration (topic 29160, post 18), which suggests this has been encountered before in a different integration.
Environment
- SonarQube Cloud
- Azure DevOps Services, SonarQube Cloud extension, dashboard widgets
- Enterprise SAML SSO
- Microsoft Edge (Chromium); third-party cookies not blocked, no site exception configured
- Pipeline analyses are unaffected; quality gates run normally via the service connection token
Thanks in advance.