HTTP secure cookie is showing a warning in Firefox

Viewed 335

When using this code snippet in Go

    cookie := http.Cookie{
        Name:  "token",
        Value: token.Key,
        Expires:  token.Claims.Expires.Time(),
        Path: "/",
        Secure:   true,
        HttpOnly: true,
        Domain:   "mydomain.net",
        SameSite: http.SameSiteStrictMode,
    }
    http.SetCookie(w, &cookie)

I get the following warning in Firefox

Cookie “token” will be soon rejected because it has the “SameSite” attribute set to “None” or an invalid value, without the “secure” attribute. To know more about the “SameSite“ attribute, read https://developer.mozilla.org/docs/Web/HTTP/Headers/Set-Cookie/SameSite

Edit

When I view the header before sending the response I see

[token=eyJhbGciOiJSUzI1NiJ9.eyJkb21haW4iOiJzZWN1cmUubG9jYWwuaG9tbGlzaC5uZXQiLCJleHAiOjE2MDczNjYwMTkuMjYyNzIyLCJpYXQiOjE2MDczNjUxMTkuMjYyNzIyLCJpZCI6MSwibmJmIjoxNjA3MzY1MTE4LjI2MjcyMiwic3ViIjoicGhvbWxpc2gifQ.NPvtLiBIR3luRV5O2sgZyksUperDDaikDv4TMMDiLYvuHfYz4on7V09PhHSA2LQ5evKKtwwLrRVPFvqqoEf9rUOQPUnXLf7P-FLzShpI7neRpu0YwzcdgmUA-phTHaXAkr6havuQWlJItt-xhG6crq4p1Cb2oSCt5p0o8ncIQXXcdmdHHaeHLwxQSzu5x0EkcjiPFyRFPYxj-S1eMXnVEQTPqWa5tESVCwU6n-QnBAQ2RT3j0gQLEKZGERKEydKHDdiBDZ9d2LZSjinp0YJ1mw2BmpMt40sJcXmBKpR_8-M_xWvMK_MbL_GDYMEGsofyJNsPBFE31fHr94i81WnEqJpgZStoA7B2PfOCpKAr-c_DeVZ3THDlMnt1RQ72Fi25tDJx6_yKV13AJskqu9D2yQgcy6vqiS2auDpmLv13X385JG7uGjKYTJvc0rWr_AuozHnfn9sKj-3yb-tWSpSwIKCMEwKB_Ta0sBxGhokHQmhV2x-S3fP9HBAr06p50rufKPbHJCcsLA2YHcPBZivVRhM3FE1H6WM_xeWwMx9Xi-yJjmNPOX5uDFyf-VurTTbxwScWzXXYwTTYkh4Mmf5AdigQ4J9HVh8WLv-nRfsSVjM_tbTP9CiieGBfyA1Upv4CXfafBdKZLrZvrUs6lu-NUc1to5dIckpJlJebI-0S5yc; Path=/; Domain=mydomain.net; Expires=Mon, 07 Dec 2020 18:33:39 GMT; HttpOnly; Secure; SameSite=Strict]"}

Note: mydomain.net is the domain of my website, changed in the post to not give away my bits. This is being done with https and valid certificates.

How can I make a cookie that Firefox will accept as secure?

Edit

After inspecting the javascript I found a line where I was experiementing left in the code:

document.cookie = "token=; expires=Thu, 01 Jan 1970 00:00:00 UTC; path=/;";
1 Answers

I had a javascript debug statement which was setting an invalid cookie which was initiating the firefox warning.

Always check your code!

Related