Cookie test doesn't currently set the cookie with required attributes for Chrome

[dibsyjr1]

Google plan on blocking cookies in the near future that aren't set with certain attributes (SameSite = 'None' and Secure), the Cookie test doesn't currently set these properties showing warnings in dev tools that it'll be blocked in a future version of Chrome, could these attributes please be applied so that there's no problems in the near future with people's existing functionality.

[Markel]

Yeah, we probably should solve this. Do you have a link to the announcement in which they detail the changes?

[dibsyjr1]

I've got a couple of websites, there's the Chromium site where they detail the launch timeline as well as a bunch of helpful links about it here:
https://www.chromium.org/updates/same-site

Then there's also this Chromium blog post about preparing for the changes:
https://blog.chromium.org/2019/10/developers-get-ready-for-new.html

[Markel]

I'm thinking that maybe we don't need to set up the cookie to be cross-site. The cookie should not be used in other websites (moreover, it is deleted once cookies are tested) and the need for a secure environment may result in bugs on HTTP sites.
Regardless, we should set up a SameSite value, as it is a good security practice, even if it is strict.

What do you think @dibsyjr1 ??

[dibsyjr1]

Well the one issue I have is that i'm using the cookies test to make sure users have cookies enabled, otherwise I force redirect them to an error page. I admit asking for it to allow for cross-site might be a bit much, only other thing I can think of is if there were an option for either strict or cross-site? If not I can just work out some other solution, it may be that i'm the only one having this issue.

[Markel]

I mean if they have cookies completely disabled strict cookies won't work. Maybe we can have options, although I admit that it may be impossible to check cross-site cookies, as we would need 2 domains (probably, not completely sure)

[dibsyjr1]

Maybe it'd make more sense to just stick with strict, this seems more like a very specific issue that i'm having than a more widespread one.

[Markel]

only other thing I can think of is if there were an option for either strict or cross-site?

Hey, I just realized that we have a issue about that #2444, although I don't really know how that could be implemented without various servers. Maybe analyzing whether a SameSite=None cookie retains its value? I really don't know and would need to be investigated.