CodePark/ questions / Cookies & state
START PRACTICINGPRACTICE
Backend question · HTTP & API design › Cookies & state

Your server sends Set-Cookie: widget=1; SameSite=None (no Secure) so an embedded widget works on partner sites. What do modern browsers do?

Reject the cookie, because SameSite=None requires Secure

Modern browsers reject the cookie, because a SameSite=None cookie must also have Secure. Without Secure, the browser blocks it. So "Store it and send it on all cross-site requests" is wrong: the browser does not store it at all. It also does not quietly change it to SameSite=Strict.

The fix is SameSite=None; Secure, served over HTTPS. Even then, third-party cookie restrictions in the browser may still block the cookie.