2

Quick overview: I open my website at domain1. Inside a page, I load an iframe with url http://domain2/...

I keep on getting this warning on chrome and it has affected my website:

A cookie associated with a cross-site resource at http://domain2 was set without the SameSite attribute. It has been blocked, as Chrome now only delivers cookies with cross-site requests if they are set with SameSite=None and Secure. You can review cookies in developer tools under Application>Storage>Cookies and see more details at https://www.chromestatus.com/feature/5088147346030592 and https://www.chromestatus.com/feature/5633521622188032.

I never had to set cookies before so I'm unaware where the cookie should be set from. I've already tried setting proxy_cookie_path in my domain2 nginx config but it doesn't seem to work:

location / {
    proxy_cookie_path / "/; SameSite=None; Secure";
}

I also tried adding Set-Cookie header which also doesn't seem to work:

location / {
    ...
    add_header 'Set-Cookie' 'SameSite=None; Secure';
}

When I tried the second solution, it seems the the header was received from the response on chrome, but chrome gives the following warning:

enter image description here

Note that domain2 is our domain as well, and it has a python backend using Flask framework. So should I add the cookies from the python code or javascript frontend?

This is getting really frustrating.

riadrifai
  • 1,108
  • 2
  • 13
  • 26
  • Try using `SameSite=Strict` in the response from server. – Liju Aug 20 '20 at 11:59
  • @Liju doesn't this block requests that are cross domain? – riadrifai Aug 20 '20 at 12:16
  • It will, If you want to use domain2 cookie in domain1, as per this [chromium blog](https://blog.chromium.org/2020/02/samesite-cookie-changes-in-february.html) you need to set the cookie as `Set-Cookie: name=value; SameSite=None; Secure;` for chrome, and in the screenshot you provided there is no cookie value pair. please check if that's the issue. – Liju Aug 20 '20 at 12:53

2 Answers2

0

Cross-Site Resource Sharing - CORS is a known issue when a request is sent through the same domain. You may try using already existing flask cors package to allow the same origin requests.

In addition, this question and answer seems relevant to yours.

Rarblack
  • 4,559
  • 4
  • 22
  • 33
0

I used this proxy_cookie_flags ~ secure samesite=none; in the blocks server { } and location { } and it worked.

DMinovski
  • 61
  • 2
  • 2
  • 7