The next stable release of Google Chrome web browser (build 80, scheduled for release on February 4, 2020) features a change in how cookies are handled. Although the changes being made is aimed at discouraging malicious cookie tracking, it is likely to have a disruptive impact on how punchout websites are accessed via Ariba Applications.

SAP Ariba allows Buyers to configure punchout catalogs to Supplier websites; when users want to shop for items from such suppliers the punchout sites are embedded within an iFrame and rendered within the Ariba Buying interfaces. This change by Google may stop the Punchout Catalog from getting rendered inside the iFrame unless the Punchout Suppliers take necessary remedial action

• Supplier Websites can place cookies inside user browser registered to their domain
• Such supplier website cookies accessed from within the iFrame are treated as cross-site cookies as the parent domain in browser address bar is still the Ariba domain
• Google Chrome will not allow access to such cookies post build 80 rollout

Who is Affected

Supplier websites accessed by Buyers via punchout and that rely on cross-site cookies are most likely to be affected by the new Chrome restriction.

Testing Your Punchout Catalogs

Buyers will be able to verify the effect of this change and test if their current punchout sites will work using Chrome versions 79 and Chrome Beta version 80.

To do this, type Chrome://flags in the Address bar, search for SameSite, and then select Enabled for the following options

• SameSite by default cookies
• Cookies without Samesite must be secure

What action to take to avoid potential disruption

To avoid potential disruption that could be caused to Buyers the below Changes will need to be adopted by Suppliers in their Punchout Sites

• Punchout Site Developers must use a new cookie setting, SameSite=None, to designate cookies for cross-site access
• Once the SameSite=None attribute is added, an additional Secure attribute must be used so cross-site cookies can only be accessed over HTTPS connections

Note: The above recommendation from Google is only applicable if your Punchout Site relies on a Cookie mechanism; If your site does not use any cookies then there is no impact.

Buyers will also have the option to not deploy Build 80 of Google Chrome version in production for their users to minimize the impact of this change until all their punchout suppliers are on-board with the necessary changes deployed on their sites.

SAP Ariba is providing this update to make sure customers are prepared for the change and are ready to implement mitigations by testing their applications. Please test your punchout sites immediately and work with your Supplier Punchout vendor to make the appropriate changes to not disrupt your buying activities.

Changes in cookie handling on Chrome browser.

You can obtain more information about the change from Google here

Catalog Management
On-Premise > On-Premise - Ariba Buyer
Purchasing
Strategic Contracts
Strategic Sourcing