"SameSite=none" does not work with iframe

google-chrome cookies samesite
Mikolay Bet picture Mikolay Bet · Mar 18, 2020 · Viewed 14.6k times · Source

After upgrade to Chrome Version 80.0.3987.132 cookies are not sent to the iframe request. On the Network tab (Chrome Dev tools), I do not see cookies for my requests.

After turning on the option "show filtered out requests cookies" I sees my cookies marked "This cookies was not sent due to user preferences."

The header for the cookie set:

set-cookie: token=jf23HaUI91Bd8L1chHq; expires=Wed, 18-Mar-2020 16:01:59 GMT; Max-Age=1799; path=/; SameSite=None; secure; domain=.example-domain.com; HttpOnly

When I open an iframe on the same domain everything works fine, but if it is a third-party domain via http or https, cookies will not work.

Has anyone come across this or know how to fix it?

Answer

Jay Shah picture Jay Shah · Apr 20, 2021

I think you should ensure that SameSite flag is always set to None for those cookies. If it's initially set to Lax, and then you try to make it None, it may not work.

Also, you should ensure that Secure flag is always set to true for SameSite=None cookies.

Related questions

SameSite warning Chrome 77

Since the last update, I'm having an error with cookies, related with SameSite attribute. The cookies are from third party developers (Fontawesome, jQuery, Google Analytics, Google reCaptcha, Google Fonts, etc.) The errors in the Chrome console are like this. A …

Read More
A cookie associated with a cross-site resource was set without the `SameSite` attribute

Chrome is giving me the following warning: A cookie associated with a cross-site resource at http://quilljs.com/ was set without the SameSite attribute. A future release of Chrome will only deliver cookies with cross-site requests if they are set …

Read More
Cross-site resource at <URL> was set without the `SameSite` attribute .NET

How to solve SameSite attribute? :1 A cookie associated with a cross-site resource at http://doubleclick.net/ was set without the SameSite attribute. A future release of Chrome will only deliver cookies with cross-site requests if they are set with SameSite=…

Read More