"SameSite=none" does not work with iframe

user_8101303 0
Viewed 22817

After upgrade to Chrome Version 80.0.3987.132 cookies are not sent to the iframe request. On the Network tab (Chrome Dev tools), I do not see cookies for my requests.

After turning on the option "show filtered out requests cookies" I sees my cookies marked "This cookies was not sent due to user preferences."

The header for the cookie set:

set-cookie: token=jf23HaUI91Bd8L1chHq; expires=Wed, 18-Mar-2020 16:01:59 GMT; Max-Age=1799; path=/; SameSite=None; secure; domain=.example-domain.com; HttpOnly

When I open an iframe on the same domain everything works fine, but if it is a third-party domain via http or https, cookies will not work.

Has anyone come across this or know how to fix it?

samesite google-chrome cookies
4 Answers

I think you should ensure that SameSite flag is always set to None for those cookies. If it's initially set to Lax, and then you try to make it None, it may not work.

Also, you should ensure that Secure flag is always set to true for SameSite=None cookies.

user_27142690

It works for me, setting cookie via PHP; This is a HACK for php < 7.3 (!)

session_set_cookie_params(3600*24, '/;SameSite=None', $_SERVER['HTTP_HOST'], true);

(secure = true is important)

user_23355990

In case of hosting in IIS you can add below configurations in web.config to avoid adding SameSite=Lex by browser

<sessionState mode="InProc" **cookieless="UseCookies" cookieSameSite="None"** timeout="20"/>
user_82649900

Deselect Block third-party cookies on chrome://settings/content/cookies

user_81013030
Related