Page within iframe not seeing its own cookies

Question

We have 2 websites on separate domains. For simplicity, let's say they are:

• "App": an SPA application running on main-app.com/app
• "Host": a simple index.html page running on random-site.com/index.html. The index.html page contains only an iframe which displays the App (points to main-app.com/app).

When I, as a user, go to the App (main-app.com/app) and log in there, it sets a session cookie in my browser which identifies the session. However, when I go to the Host page (random-site.com/index.html) and it loads the App's iframe, the session cookie is not being sent. It is simply omitted when I look at it in the network inspector.

Why would this be happening? What is preventing the cookie from being sent, and how can we fix this?

(We have control over both sites)

Answer 1

Are you using Google Chrome? In Google Chrome, the default attribute for cookies has been changed to samesite=lax. samesite=lax cookies are not sent in iframes. The purpose of this change is to mitigate attacks such as CSRF. If you use Firefox, you should still be logged in on the page in the iframe.