When using this code snippet in Go
cookie := http.Cookie{
Name: "token",
Value: token.Key,
Expires: token.Claims.Expires.Time(),
Path: "/",
Secure: true,
HttpOnly: true,
Domain: "mydomain.net",
SameSite: http.SameSiteStrictMode,
}
http.SetCookie(w, &cookie)
I get the following warning in Firefox
Cookie “token” will be soon rejected because it has the “SameSite” attribute set to “None” or an invalid value, without the “secure” attribute. To know more about the “SameSite“ attribute, read https://developer.mozilla.org/docs/Web/HTTP/Headers/Set-Cookie/SameSite
Edit
When I view the header before sending the response I see
[token=eyJhbGciOiJSUzI1NiJ9.eyJkb21haW4iOiJzZWN1cmUubG9jYWwuaG9tbGlzaC5uZXQiLCJleHAiOjE2MDczNjYwMTkuMjYyNzIyLCJpYXQiOjE2MDczNjUxMTkuMjYyNzIyLCJpZCI6MSwibmJmIjoxNjA3MzY1MTE4LjI2MjcyMiwic3ViIjoicGhvbWxpc2gifQ.NPvtLiBIR3luRV5O2sgZyksUperDDaikDv4TMMDiLYvuHfYz4on7V09PhHSA2LQ5evKKtwwLrRVPFvqqoEf9rUOQPUnXLf7P-FLzShpI7neRpu0YwzcdgmUA-phTHaXAkr6havuQWlJItt-xhG6crq4p1Cb2oSCt5p0o8ncIQXXcdmdHHaeHLwxQSzu5x0EkcjiPFyRFPYxj-S1eMXnVEQTPqWa5tESVCwU6n-QnBAQ2RT3j0gQLEKZGERKEydKHDdiBDZ9d2LZSjinp0YJ1mw2BmpMt40sJcXmBKpR_8-M_xWvMK_MbL_GDYMEGsofyJNsPBFE31fHr94i81WnEqJpgZStoA7B2PfOCpKAr-c_DeVZ3THDlMnt1RQ72Fi25tDJx6_yKV13AJskqu9D2yQgcy6vqiS2auDpmLv13X385JG7uGjKYTJvc0rWr_AuozHnfn9sKj-3yb-tWSpSwIKCMEwKB_Ta0sBxGhokHQmhV2x-S3fP9HBAr06p50rufKPbHJCcsLA2YHcPBZivVRhM3FE1H6WM_xeWwMx9Xi-yJjmNPOX5uDFyf-VurTTbxwScWzXXYwTTYkh4Mmf5AdigQ4J9HVh8WLv-nRfsSVjM_tbTP9CiieGBfyA1Upv4CXfafBdKZLrZvrUs6lu-NUc1to5dIckpJlJebI-0S5yc; Path=/; Domain=mydomain.net; Expires=Mon, 07 Dec 2020 18:33:39 GMT; HttpOnly; Secure; SameSite=Strict]"}
Note: mydomain.net is the domain of my website, changed in the post to not give away my bits. This is being done with https and valid certificates.
How can I make a cookie that Firefox will accept as secure?
Edit
After inspecting the javascript I found a line where I was experiementing left in the code:
document.cookie = "token=; expires=Thu, 01 Jan 1970 00:00:00 UTC; path=/;";