Cookie “cookieName” will be soon rejected because it has the “sameSite” attribute set to “none” or an invalid value on clearCookie

user_10940806 0
Viewed 7582

I have an express API with the following code in order to set a cookie:

...
res.setHeader("Access-Control-Allow-Origin", ip);
res.cookie(name, token, { maxAge: 30000, httpOnly: true, secure: false, sameSite: "Lax" });
...

And this other to clear the cookie:

...
res.clearCookie(name);
...

When I execute the second one, I got the following error message: Cookie “cookieName” will be soon rejected because it has the “sameSite” attribute set to “none” or an invalid value on clearCookie

Some details:

  • The error shows up only in Firefox, not in Chrome.
  • Before setting sameSite: "Lax", I received the error message twice, after setting the cookie as well as when clearing it. After setting sameSite to Lax, the problem only appeared when clearing the cookie.

Any help? Let me know if you need more details, versions, code...

express firefox cookies
2 Answers

You are facing an HTTP issue. The general rule, that for setting or deleting cookie, you have to set all parameters same (except value and expiration time). The correct solution for your problem is described in the answer https://stackoverflow.com/a/20320610/941493 and in RFC 6265.

Finally, to remove a cookie, the server returns a Set-Cookie header with an expiration date in the past. The server will be successful in removing the cookie only if the Path and the Domain attribute in the Set-Cookie header match the values used when the cookie was created.

Also it is written in the documentation of clearCookie:

Web browsers and other compliant clients will only clear the cookie if the given options is identical to those given to res.cookie(), excluding expires and maxAge.

So in your case call cookie command with expires in the past or clearCookie with the same parameters you used for creating cookie.

user_9414930

Both cookie and clearCookie need the same params.

    res.clearCookie(name, { maxAge: 30000, httpOnly: true, secure: false, sameSite: "Lax" })
user_93107340
Related