Search code examples
google-chromecookiesiframechromiumsamesite

Fix Not Working: A cookie associated with a cross-site resource was set without the `SameSite` attribute

I maintain an old ASP site for my company.

We have two different domains, A and B. Domain B appears in an iFrame, and we've been getting the SameSite warning.

The solution seems to involve adding "SameSite=None; Secure" to the header.

I added those values, and they show up in Chrome dev tools: enter image description here

Despite the change:

  • The warning still shows up.
  • When enabled, the SameSite experimental features still block the cookie on the host site.

Anyone know what I might be doing wrong here?

Solution

  • What you have showing there is two cookies, one with the session id, and another whose name is SameSite. Neither of these have any SameSite attribute (hence the blank space under the SameSite column).

    You're not supposed to set a separate cookie for SameSite=None. SameSite is a cookie attribute, which is meant to be attached to the cookie it refers to.

    The way you use it is like this: Set-Cookie: sessionid=12345; SameSite=None; Secure. Note that this is a single Set-Cookie header. If you use two separate Set-Cookie lines, the browser will interpret it as two separate cookies, which is not what you want.