Chrome Update Requiring Cookies to Have SameSite
See original GitHub issueWhen authenticating a user with the package, I receive the following in Chrome Dev tools. Not sure if the cookie is being set on the react-google-login
side, but thought I’d flag it just in case. If so, the cookie must be set with SameSite=None
and Secure
.
A cookie associated with a cross-site resource at <URL> was set without the
SameSiteattribute. A future release of Chrome will only deliver cookies with cross-site requests if they are set with
SameSite=Noneand
Secure. You can review cookies in developer tools under Application>Storage>Cookies and see more details at <URL> and <URL>.
Issue Analytics
- State:
- Created 4 years ago
- Reactions:26
- Comments:7
Top Results From Across the Web
Get Ready for New SameSite=None; Secure Cookie Settings
With Chrome 80 in February, Chrome will treat cookies that have no declared SameSite value as SameSite=Lax cookies. Only cookies with the SameSite=None...
Read more >SameSite Updates - The Chromium Projects
Go to chrome://flags and enable #same-site-by-default-cookies and #cookies-without-same-site-must-be-secure. Restart the browser for the changes to take effect.
Read more >Prepare for SameSite Cookie Updates - Heroku Blog
As previously stated, Google Chrome will stop sending third-party cookies in cross-site requests unless the cookies are secured and flagged ...
Read more >Google Rolls Out SameSite Cookie Changes to Chrome
The SameSite update changes how the web browser handles third-party cookies as a way to avoid possible cross-site request forgery (CSRF) ...
Read more >WTF is Chrome's SameSite cookie update? - Digiday
The SameSite update will require website owners to explicitly state label the third-party cookies that can be used on other sites. Cookies ...
Read more >Top Related Medium Post
No results found
Top Related StackOverflow Question
No results found
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start FreeTop Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found
Top GitHub Comments
As a work around until google fixes their end. You can disable SameSite by default in chrome flags.
if that markdown link doesn’t work
chrome://flags/#same-site-by-default-cookies
Feels like this is causing issues still, for me it looks like the
onSuccess
andonFailure
callbacks are not called with theSameSite
flags enabled in Chrome. Disabling the flags in Chrome makes theGoogleLogin
component work as expected again - both callbacks called,isSignedIn
flag working etc.Environment react-google-login: ^5.1.20 Chrome Version 84.0.4147.105 (Official Build) (64-bit)