111

Since the last update, I'm having an error with cookies, related with SameSite attribute.

The cookies are from third party developers (Fontawesome, jQuery, Google Analytics, Google reCaptcha, Google Fonts, etc.)

The errors in the Chrome console are like this.

A cookie associated with a cross-site resource at <URL> was set without the `SameSite` attribute. A future release of Chrome will only deliver cookies with cross-site requests if they are set with `SameSite=None` and `Secure`. You can review cookies in developer tools under Application>Storage>Cookies and see more details at <URL> and <URL>.
(index):1 A cookie associated with a cross-site resource at http://jquery.com/ was set without the `SameSite` attribute. A future release of Chrome will only deliver cookies with cross-site requests if they are set with `SameSite=None` and `Secure`. You can review cookies in developer tools under Application>Storage>Cookies and see more details at https://www.chromestatus.com/feature/5088147346030592 and https://www.chromestatus.com/feature/5633521622188032.
(index):1 A cookie associated with a cross-site resource at http://fontawesome.com/ was set without the `SameSite` attribute. A future release of Chrome will only deliver cookies with cross-site requests if they are set with `SameSite=None` and `Secure`. You can review cookies in developer tools under Application>Storage>Cookies and see more details at https://www.chromestatus.com/feature/5088147346030592 and https://www.chromestatus.com/feature/5633521622188032.
(index):1 A cookie associated with a cross-site resource at http://google.com/ was set without the `SameSite` attribute. A future release of Chrome will only deliver cookies with cross-site requests if they are set with `SameSite=None` and `Secure`. You can review cookies in developer tools under Application>Storage>Cookies and see more details at https://www.chromestatus.com/feature/5088147346030592 and https://www.chromestatus.com/feature/5633521622188032.
(index):1 A cookie associated with a cross-site resource at https://google.com/ was set without the `SameSite` attribute. A future release of Chrome will only deliver cookies with cross-site requests if they are set with `SameSite=None` and `Secure`. You can review cookies in developer tools under Application>Storage>Cookies and see more details at https://www.chromestatus.com/feature/5088147346030592 and https://www.chromestatus.com/feature/5633521622188032.
(index):1 A cookie associated with a cross-site resource at https://www.google.com/ was set without the `SameSite` attribute. A future release of Chrome will only deliver cookies with cross-site requests if they are set with `SameSite=None` and `Secure`. You can review cookies in developer tools under Application>Storage>Cookies and see more details at https://www.chromestatus.com/feature/5088147346030592 and https://www.chromestatus.com/feature/5633521622188032.
(index):1 A cookie associated with a cross-site resource at http://www.google.com/ was set without the `SameSite` attribute. A future release of Chrome will only deliver cookies with cross-site requests if they are set with `SameSite=None` and `Secure`. You can review cookies in developer tools under Application>Storage>Cookies and see more details at https://www.chromestatus.com/feature/5088147346030592 and https://www.chromestatus.com/feature/5633521622188032.
(index):1 A cookie associated with a cross-site resource at http://gstatic.com/ was set without the `SameSite` attribute. A future release of Chrome will only deliver cookies with cross-site requests if they are set with `SameSite=None` and `Secure`. You can review cookies in developer tools under Application>Storage>Cookies and see more details at https://www.chromestatus.com/feature/5088147346030592 and https://www.chromestatus.com/feature/5633521622188032.

Is there anything I need to do in my local machine or server or is just some feature they should implement in future releases of their libraries?

  • 6
    nothing to do with your code. its something their web servers will have to support. – Daniel A. White Oct 7 '19 at 13:39
  • I have the same problem, does this mean we can't use third-party websites in our code? – Love2Code Oct 7 '19 at 19:45
  • You can use the libraries without any problem. It is just a warning the console will throw until they implement that in their servers as @DanielA.White said before. – peiblox Oct 9 '19 at 7:14
  • 4
    And what exactly happens if the 3rd party does not fix their cookies by the date that A future release of Chrome will only deliver ... - will my site break? Looks like that future date is 02/04/2020 - not too far away. – JK. Nov 26 '19 at 21:24
  • I am getting this warning on a local development server in a page that does not use any Google APIs, yet the warning specifically mentions gstatic.com. So weird. – corwin.amber Jan 11 at 12:17
83

This console warning is not an error or an actual problem — Chrome is just spreading the word about this new standard to increase developer adoption.

Release date for a fix is February 4, 2020 per: https://www.chromium.org/updates/same-site

I solved same problem by adding in response header

response.setHeader("Set-Cookie", "HttpOnly;Secure;SameSite=Strict");

SameSite prevents the browser from sending the cookie along with cross-site requests. The main goal is mitigating the risk of cross-origin information leakage. It also provides some protection against cross-site request forgery attacks. Possible values for the flag are Lax or Strict.

SameSite cookies explained here

Please refer this before applying any option.

Hope this helps you.

  • 27
    Have you done any research on how this could be handled when pulling in 3rd party scripts that set cookies (like Google Analytics and Google Tag Manager)? – BRass Oct 14 '19 at 19:47
  • 13
    where should i add the response header? thanks. – Kris Wen Oct 19 '19 at 0:06
  • 1
    If perchance you're using .NET, appending the web.config or adding URL ReWrite rules in IIS would address this issue. Credit goes to the solution at stackoverflow.com/questions/38954821/… – BDarley Oct 25 '19 at 14:10
  • 3
    Is there a solution that does not involve JavaScript? – posfan12 Oct 27 '19 at 11:50
  • @BRass I'm loading Google Map tile layer in my application as a 3rd party script/URL. I have not done any research with other 3rd party scripts. – Rahul Mahadik Oct 30 '19 at 9:04
2

To elaborate on Rahul Mahadik's answer, this works for MVC5 C#.NET:

AllowSameSiteAttribute.cs

public class AllowSameSiteAttribute : ActionFilterAttribute
{
    public override void OnActionExecuting(ActionExecutingContext filterContext)
    {
        var response = filterContext.RequestContext.HttpContext.Response;

        if(response != null)
        {
            response.AddHeader("Set-Cookie", "HttpOnly;Secure;SameSite=Strict");
            //Add more headers...
        }

        base.OnActionExecuting(filterContext);
    }
}

HomeController.cs

    [AllowSameSite] //For the whole controller
    public class UserController : Controller
    {
    }

or

    public class UserController : Controller
    {
        [AllowSameSite] //For the method
        public ActionResult Index()
        {
            return View();
        }
    }

Not the answer you're looking for? Browse other questions tagged or ask your own question.