question-mark
Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Chrome Update Requiring Cookies to Have SameSite

See original GitHub issue

When authenticating a user with the package, I receive the following in Chrome Dev tools. Not sure if the cookie is being set on the react-google-login side, but thought I’d flag it just in case. If so, the cookie must be set with SameSite=None and Secure.

A cookie associated with a cross-site resource at <URL> was set without the SameSiteattribute. A future release of Chrome will only deliver cookies with cross-site requests if they are set withSameSite=NoneandSecure. You can review cookies in developer tools under Application>Storage>Cookies and see more details at <URL> and <URL>.

Issue Analytics

  • State:open
  • Created 4 years ago
  • Reactions:26
  • Comments:7

github_iconTop GitHub Comments

5reactions
7imbrookcommented, Nov 7, 2019

As a work around until google fixes their end. You can disable SameSite by default in chrome flags.

if that markdown link doesn’t work chrome://flags/#same-site-by-default-cookies

Screen Shot 2019-11-06 at 10 14 13 PM 1
4reactions
lelumeescommented, Aug 10, 2020

Feels like this is causing issues still, for me it looks like the onSuccess and onFailure callbacks are not called with the SameSite flags enabled in Chrome. Disabling the flags in Chrome makes the GoogleLogin component work as expected again - both callbacks called, isSignedIn flag working etc.

Environment react-google-login: ^5.1.20 Chrome Version 84.0.4147.105 (Official Build) (64-bit)

Read more comments on GitHub >

github_iconTop Results From Across the Web

Get Ready for New SameSite=None; Secure Cookie Settings
With Chrome 80 in February, Chrome will treat cookies that have no declared SameSite value as SameSite=Lax cookies. Only cookies with the SameSite=None...
Read more >
SameSite Updates - The Chromium Projects
Go to chrome://flags and enable #same-site-by-default-cookies and #cookies-without-same-site-must-be-secure. Restart the browser for the changes to take effect.
Read more >
Prepare for SameSite Cookie Updates - Heroku Blog
As previously stated, Google Chrome will stop sending third-party cookies in cross-site requests unless the cookies are secured and flagged ...
Read more >
Google Rolls Out SameSite Cookie Changes to Chrome
The SameSite update changes how the web browser handles third-party cookies as a way to avoid possible cross-site request forgery (CSRF) ...
Read more >
WTF is Chrome's SameSite cookie update? - Digiday
The SameSite update will require website owners to explicitly state label the third-party cookies that can be used on other sites. Cookies ...
Read more >

github_iconTop Related Medium Post

No results found

github_iconTop Related StackOverflow Question

No results found

github_iconTroubleshoot Live Code

Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free

github_iconTop Related Reddit Thread

No results found

github_iconTop Related Hackernoon Post

No results found

github_iconTop Related Tweet

No results found

github_iconTop Related Dev.to Post

No results found

github_iconTop Related Hashnode Post

No results found