Add Secure to SameSite=None cookies

Why it matters

Browsers reject a cookie marked SameSite=None unless it also has Secure, so this cookie is silently dropped and whatever depends on it, such as an embedded widget or a login, fails. Add Secure, or use SameSite=Lax if the cookie is not needed in cross-site requests.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. Stage 1: decide whether the cookie really has to be sent in cross-site requests (embedded in another site's frame, cross-site single sign-on). If not, change it to SameSite=Lax.
2. Stage 2: if it does, add Secure where the cookie is created, make sure the pages that set and use it run on https, and test the embed or login flow.

Set-Cookie: widget_session=VALUE; Path=/; Secure; HttpOnly; SameSite=None

Read the documentation ↗(opens in a new tab)

Related

• Reported by the Cookie flags check
• Add the Secure flag to cookies
• Make session cookies HttpOnly
• Set SameSite on session cookies