Testing requirements: Chrome (version >= 68) Firefox IE Edge PHP 7.0 PHP 7.2 PHP 7.3 Setup Open Chrome Visit chrome://flags/#same-site-by-default-cookies Enable the experiment Visit chrome://flags/#cookies-without-same-site-must-be-secure Enable the experiment Relaunch Chrome Scenario 1: Disallow sync XHR in page dismissal Scenario 1 alternative The following test must be run using Chrome, and at least one other browser (any will do) Create a SCORM activity using the same package from the behat test ( RuntimeBasicCalls_SCORM20043rdEdition.zip ). As a learner start an attempt and progress a couple of pages in. Note the title of the SCORM page you are on. Follow another link on the site, the navbar for instance. It must redirect the tab out of the SCORM activity. Navigate back to the course, and the SCORM activity and resume your attempt. You should be taken back to the last page that you were on. Progress one page and note the title Log out Log back in (this is to generate a new session cookie) Return to the SCORM activity, resume your attempt Confirm you get back to the last title Scenario 2: Cookies default to SameSite=(Empty) and reject insecure SameSite=None cookies This scenario should be executed in as many browsers and PHP versions as possible (IE, Chrome, Firefox, Safari and PHP 7.2, PHP 7.3). Note: Between each test make sure you close your browser completely or purge all history and state. You need it to dispose of the cookie completely in order for the test to be accurate. The samesite attribute is sticky. Alternatively you can make use of an Incognito/Private browsing window and make sure that it is fully closed between each test SameSite=None This set of tests will need to be run using the following versions of PHP: PHP 7.0 (3.5, 3.6) PHP 7.2 (3.7, 3.8, master) PHP 7.3 (3.7, 3.8, master) This test must be run against at the least the following browers: Chrome >= 68 with the experimental flags enabled Firefox IE Edge Therefore we have the following combinations: Moodle 3.5, PHP 7.0, Chrome Moodle 3.5, PHP 7.0, Firefox Moodle 3.5, PHP 7.0, IE Moodle 3.5, PHP 7.0, Edge Moodle 3.6, PHP 7.0, Chrome Moodle 3.6, PHP 7.0, Firefox Moodle 3.6, PHP 7.0, IE Moodle 3.6, PHP 7.0, Edge Moodle 3.7, PHP 7.2, Chrome Moodle 3.7, PHP 7.2, Firefox Moodle 3.7, PHP 7.2, IE Moodle 3.7, PHP 7.2, Edge Moodle 3.7, PHP 7.3, Chrome Moodle 3.7, PHP 7.3, Firefox Moodle 3.7, PHP 7.3, IE Moodle 3.7, PHP 7.3, Edge Moodle 3.8, PHP 7.2, Chrome Moodle 3.8, PHP 7.2, Firefox Moodle 3.8, PHP 7.2, IE Moodle 3.8, PHP 7.2, Edge Moodle 3.8, PHP 7.3, Chrome Moodle 3.8, PHP 7.3, Firefox Moodle 3.8, PHP 7.3, IE Moodle 3.8, PHP 7.3, Edge Moodle master, PHP 7.2, Chrome Moodle master, PHP 7.2, Firefox Moodle master, PHP 7.2, IE Moodle master, PHP 7.2, Edge Moodle master, PHP 7.3, Chrome Moodle master, PHP 7.3, Firefox Moodle master, PHP 7.3, IE Moodle master, PHP 7.3, Edge No SSL Visit your site directly (Do not use ngrok or https) - e.g. http://localhost/im Log in Open the developer tools (Usually F12) Locate the Cookie storage. In most browsers this is in somewhere like an "Application" or "Storage" tab in the developer tools Expand the "Cookies" section, and click on the hostname Confirm that you can see a "MoodleSession" cookie Confirm that the "Secure" column is false, or not ticked Confirm that the "SameSite" colum is Unset, or empty SSL Visit your site using ngrok - e.g. https://mysite.au.ngrok.io/im Log in Open the developer tools (Usually F12) Locate the Cookie storage. In most browsers this is in somewhere like an "Application" or "Storage" tab in the developer tools Expand the "Cookies" section, and click on the hostname Confirm that you can see a "MoodleSession" cookie Confirm that the "Secure" column is true, or ticked If you are using Chrome: Confirm that the "SameSite" colum is set to "None" If you are not using Chrome: Confirm that the "SameSite" colum is Unset, or empty Tidyup Open Chrome In the address bar visit chrome://flags Press "Reset all to default" Relaunch Chrome