Chrome’s Changes Could Break Your App: Prepare for SameSite Cookie Updates

Summary

Chrome's SameSite changes alter when third-party cookies are sent in cross-site requests, affecting sites that rely on embedded services, analytics, advertising, or other cross-domain functionality. Starting February 4, 2020, Chrome was to reject such cookies unless they were secured and assigned an appropriate SameSite value, as part of a secure-by-default model intended to reduce CSRF attacks, other vulnerabilities, and privacy leaks. The post explains first- versus third-party cookies, contrasts Strict, Lax, and None, and gives scenarios for selecting each setting; SameSite=None must be paired with Secure and HTTPS. It also recommends enabling Chrome 80 flags to test for errors, then updating application cookies or coordinating with third-party providers. Server-side support is noted for PHP, NodeJS, Python, Flask, and Ruby on Rails, with direct JavaScript cookie handling also mentioned.

Takeaways

1. 1

   SameSite=Strict blocks cross-site sharing, while SameSite=Lax permits cookies on top-level navigation using a safe method such as GET.

2. 2

   SameSite=None preserves cross-site cookie use but must be combined with Secure; otherwise Chrome rejects the cookie.

3. 3

   Testing involves enabling SameSite-related Chrome flags, checking for errors, and updating server-side or JavaScript cookie handling where needed.