Search code examples
javascriptcookiesgoogle-apigoogle-signinsamesite

google sign in api (platform.js) setting cookies without SameSite attribute?


On using the google sign-in api [https://apis.google.com/js/platform.js]. I noticed some messages in chrome (which i believe i hadn't seen before, so possibly a recent warning). Below is one of them (but others are on the same lines with different google domains).

A cookie associated with a cross-site resource at http://google.com/ was set without the SameSite attribute.

Is there are fix/change that users of platform.js might need to make for these to go away?


Solution

  • The warning is specifically for google.com meaning that it's Google that needs to fix the attributes on their cookie. The warning is purely informational at this point. This new default behaviour will not apply until the Chrome 80 release, which will be stable in February 2020. It should not be affecting the functionality of your site at this point.

    You can learn more about the changes at https://web.dev/samesite-cookies-explained.

    You can also test if your browser is applying the new restrictions by visiting https://samesite-sandbox.glitch.me If the results are all green then your browser is applying the new restrictions and it will impact site functionality where cookies have not been fixed by the provider. However, if there is any orange or red on the board, then the new restrictions are not being applied and the warning should not be affecting any functionality.