SameSite=Strict cookies not sent on reload in Chrome

Viewed 201

I can reproduce the issue by following these steps with a website I host:

  1. Click a link to the website from any external site
  2. Submit an AJAX form that returns a Set-Cookie header with the SameSite=Strict attribute
    1. At this point I can confirm that the cookie is set by looking in chrome://settings
  3. Reload the page

On step 3, the cookie is not sent with the request. The devtools network tab shows

The cookie was blocked because it had the "SameSite=Strict" attribute and the request was made from a different site. This includes top-level navigation requests initiated by other sites.

Is this the correct behavior for SameSite=Strict cookies? I understand why the cookie would not be sent with the initial request in step 1 (since it originated from a different site), but I expected that an explicit reload triggered by a user would be considered a same-site request.

samesite cookie blocked

0 Answers
Related