google has started deprecating Third party cookies (samesite=none essentially) in 2024. You might be among the 1% experiment. that might explain why it's working anymore. I wrote about this here and left resources too. medium.com/@hnasr/google-is-deprecating-3rd-party-cookies-d987603607a7
Yeah, I just noticed. I have a web application in nextjs and django. It's working fine on Firefox and GNOME Web (a.k.a. Safari lol), but it's authentication stopped working on Chromium (cookies aren't being set). Thanks man!
Hussein go bless for explaining this feature so nicely. Even after reading/watching 10's of video - the concept was not clear. Seriously you did a great job explaining it so easily with a practical example
Thanks a lot brother, I recently made a new website and the front end and backend are hosted on two different services, I was breaking my head over why the browser was not sending cookies. This explains why. I guess I have to use some other way, since google deprecated cross site cookies
This is how you explain things!!!!! Thank you so much 🙏🙏🙏. Google Chrome team should use this as their office video because their video is just a crap.
Thank brother I really appreciate your work and get a lot of experience from you, my question is isn't cookies shloud just work for the same domain?، I mean it shouldn't be exists if you open a new tab for another domain
Still don't know why there's cookie for the second site referencing image from the first one when both are open in chrome. But when one is open in chrome & 2nd in fox it doesn't seem to work.
what makes the image display only with the cookie? I thought the cookie being strict means it lets you access the cookie itself from the same site only. where is the code for the img, and how do you make it follow the cookie settings?
@hnasr usually when you visit a site, the server will send the cookie to the browser right. But in the video, you have mentioned several times that "Browser" will not send the cookie if it's cross site. Can you explain on this please ?
Please some one clear my doubt, The image of one domain is getting loaded on another domain if the attribute Same-site has the value None right but what about the SOP (Same Origin Policy) ain't it gonna block the responses from cross domain ?
What if we want to make any request from Domain A through api call to fetch information from Domain B when same site = Strict ? what is the way to achieve the same
@@hnasr Hmm but according to owasp.org/www-community/attacks/csrf#other-http-methods, JavaScript is subject to same-origin policy. ...which means if AJAX is used to make a request from your other origin (hnasr.github.io), it won't be executed in the first place.
Is it possible they have patched this? I can't get cross-site cookies working! I used your express file and uploaded to render. Then I also made a GitHub page with an image src pointing to the render https link, but the cookie is never sent!!
Is it possible to access samesite lax cookie in case api is integrated with openid connect for single sign on. Currently why they are inaccessible because oidc url auto redirects to my api and at that time api try to read the cookies at server side. Any suggestions on this please??
Thanks for the explanation Hussein. I got one question ..if someone is using my site login page on their website then who would set the samesite : none (I as a site owner or the one who is using our login page). Could you please help me find this. I have set in my code samesite:none but when I am trying to login through their site it still showing samesite:Lax while when I login through mysite changes are reflecting as none
You can’t that is the security aspect of cookies. They are set by the owner of the domain You can set the cookie from the client side with Javascript document.cookie but still you would have injected some code to do so in someone else’s domain
I need same site mode strict but then my redirection from a payment site is not working. Is there any solution to keep it working without changing same site strict mode?
I think its safe to use lax for your use case since you are redirecting. I don’t know if you can use strict and still send the cookies while redirecting..
why redirection to a site not working when same site is lax but the request from another site is 'post'? will this works only for 'GET'? Iam getting issue when my my site is redirected from a payment gateway. They are redirecting using a POST request.
AMR K Post requests won’t send lax cookies to cross site, there is however an exception if those lax cookies are created within two minutes A SameSite Cookie Exception was made to avoid Redirect Loop in Single Sign-On (SSO) Let us Discuss ru-vid.com/video/%D0%B2%D0%B8%D0%B4%D0%B5%D0%BE-4QiD8cvzCN0.html
Still Having trouble with SameSite? Rowan from Google is willing to help one-on-one check his twitter twitter.com/rowan_m/status/1280821505757044736?s=21
Thanks, Hussein! Definitely happy to chat with people. Hearing about the issues people are having helps me in turn improve the documentation and samples too.
@@FLUTTERMAD Domain and Path specify requirements for the request with the cookie, SameSite specifies a requirement for the *context* of the request. e.g. Domain can control if the cookies goes to sub1.example.com or sub2.example.com while SameSite specifies if the cookie should go to sub1.example.com when the request comes from another site, like google.com.