CODEWITHSUNDEEP
google-chromecookiessamesite
silkfire
silkfire

Reputation: 25935

Chrome 80 allows insecure SameSite=None cookies

I recently upgraded to Chrome 80 and enabled the new SameSite policy for cookies in chrome://flags. While developing locally, my server framework is set up to emit the authentication cookies with the SameSite=None attribute. For the time being I don't have SSL enabled.

Now I'm wondering, how come Chrome allows these, as, if I've understood the policy correctly, all SameSite=None cookies must be secure, regardless of environment?

enter image description here

enter image description here

Upvotes: 2

Views: 1373

Answers (1)

rowan_m
rowan_m

Reputation: 3050

Yes, you will only be able to set SameSite=None with Secure. So, I think if you do not have SSL in your dev environment, you should not set either of these attributes.

The new behaviour comes from both:

  • chrome://flags/#same-site-by-default-cookies
  • and chrome://flags/#cookies-without-same-site-must-be-secure

You can check if your browser is enforcing the complete behaviour on https://samesite-sandbox.glitch.me

Upvotes: 2

Related Questions