Actualice las cookies de su sitio para prepararse para los próximos cambios en el comportamiento del attribute SameSite.
Updated
Safe and secure
Chrome,
Firefox,
Edge, and others will change their default behavior according to the IETF initiative,
Cookies getting better and better
therefore that:
- cookies without
SameSite
The attribute will be treated asSameSite=Lax
, which means that the default behavior will be to restrict cookies to proper contexts only. - Cookies for use between sites has to specify
SameSite=None; Secure
to allow inclusion in the context of third parties.
This feature is the default behavior from chrome 84 stable onwards. If you have not already done so, you should update the attributes of your third-party cookies so that they are not blocked in the future.
Compatibilidad con muchos browsers
Watch the
Browser compatibility
mdn section Set-Cookie
page.
Use Cases for Cross-Site or Third-Party Cookies
There are a number of common use cases and patterns where cookies need to be sent in a third-party context. If you provide or rely on one of these use cases, please ensure that either you or the provider are updating your cookies to ensure the service continues to function properly.
Content dentro de un
Content from a different site displayed on a It is in a third party context. The standard use cases here are:
- Embedded content shared from other sites, such as videos, maps, code samples, and social posts.
- Widgets de servicios externos como pagos, calendarios, reserva y funcionalidad de reserva.
- Widgets like social buttons or anti-fraud services that create less obvious
.
Cookies may be used here to, among other things, maintain session state, store general preferences, enable statistics, or personalize content for users with existing accounts.

If the embedded content does not come from the same site as the top-level browsing context, it is third-party content.
Al mismo tiempo, puesto que la Web es intrínsecamente componible, they are used to embed content that is further displayed in its own or top-level context. Cookies used by that site will be considered third party cookies when the site is displayed within the frame. If you're building sites that you want others to easily embed while relying on cookies to work, you'll also need to make sure they're marked for cross-site use or that you can gracefully go back without them.
“Insecure” requests on all sites
Aunque «inseguro» puede parecer un poco preocupante aquí, esto se refiere a cualquier solicitud que pueda tener la intención de cambiar de estado. En la web, son principalmente solicitudes POST. Cookies marcadas como SameSite=Lax
It will be sent in secure top-level navigations, for example, when you click on a link to go to a different site. However, something like a
sending via POST to a different site would not include cookies.

If the incoming request uses a "secure" method, cookies will be sent.
Este patrón se usa para sitios que pueden redirigir al Username a un servicio remoto para realizar alguna operación antes de regresar, a modo de ejemplo, redirigir a un proveedor de identidad de terceros. Antes de que el usuario abandone el sitio, se define una cookie que contiene un token de un solo uso con la expectativa de que este token se pueda verificar en la solicitud de retorno para mitigar
Cross-Site Request Forgery (CSRF)
Attacks If that return request arrives via POST, it will be necessary to mark the cookies as SameSite=None; Secure
.
remote resources
Any remote resource on a page can depend on cookies to be sent with a request, from <img>
tags, labels etc Common use cases include pixel tracking and content personalization.
Esto además se aplica a las solicitudes iniciadas desde su JavaScript for fetch
or
XMLHttpRequest
. Yes fetch ()
is called with the
credentials: 'include'
option
this is a good indication that cookies can be expected on those requests. by XMLHttpRequest
should look for instances of the
withCredentials
property
being set to true
. This is a good indication that cookies can be expected on those requests. Those cookies will need to be properly marked to be included in cross-site requests.
Content inside a WebView
Un WebView en una aplicación nativa funciona con un browser y deberá probar si se aplican las mismas restricciones o problemas. En Android, si WebView funciona con Chrome, los nuevos valores predeterminados I will not do it be applied immediately with Chrome 84. However, they are intended to be applied in the future, so you should still test and prepare for it. At the same time, Android makes it possible for native applications to set cookies directly through the
Cookie Manager API. Del mismo modo que con las cookies configuradas a través de headers o JavaScript, considere incluir
SameSite=None; Secure
if they are intended for cross-site use.
How to implement SameSite
today
For cookies that are only needed in their own context, ideally mark them as SameSite=Lax
or SameSite=Strict
depending on your needs. You can also choose to do nothing and allow the browser to apply its default value, but this carries the risk of inconsistent behavior between browsers and possible console warnings for each cookie.
Set-Cookie: first_party_var=value; SameSite=Lax
For cookies that are essential in a third-party context, you will need to ensure that they are marked as SameSite=None; Secure
. Note that it requires both attributes together. If you only specify None
without secure
the cookie will be rejected. However, there are some mutually incompatible differences in browser implementations, so you may need to use some of the mitigation strategies described in Handling incompatible clients below.
Set-Cookie: third_party_var=value; SameSite=None; secure
Handling incompatible clients
As these changes to include None
and the default update behavior is relatively new, there are inconsistencies between browsers regarding how these changes are handled. You can check the
updates page on chromium.org
for known issues at this time, however, it is not possible to say whether it is exhaustive. Although this is not ideal, there are workarounds you can use during this transition stage. However, the general rule is to treat incompatible clients as a special case. Do not create an exception for browsers that implement the newer rules.
The first option is to set the old and new style cookies:
Set-cookie: 3pcookie=value; SameSite=None; Secure
Set-cookie: 3pcookie-legacy=value; Secure
Browsers implementing the newer behavior will set the cookie with the SameSite
value, while other browsers may ignore it or set it incorrectly. However, those same browsers will set the 3pcookie-legacy
Cookie. When processing embedded cookies, the site must first check for the presence of the new style cookie, and if it is not found, then fall back to the legacy cookie.
The following example shows how to do this in Node.js, making use of the
express frame And it is
cookie analyzer middleware.
const express = require('express');
const cp = require('cookie-parser');
const app = express();
app.use(cp());app.get('/set', (req, beef) => {
beef.cookie('3pcookie', 'value', { sameSite: 'none', secure: true });
beef.cookie('3pcookie-legacy', 'value', { secure: true });
beef.end();
});
app.get('/', (req, beef) => {
let cookieVal = null;
if (req.cookies['3pcookie']) {
cookieVal = req.cookies['3pcookie'];
} else if (req.cookies['3pcookie-legacy']) {
cookieVal = req.cookies['3pcookie-legacy'];
}
beef.end();
});
app.listen(process.env.PORT);
The downside is that this means setting redundant cookies to cover all browsers and you need to make changes to both the set point and the cookie read. However, this approach should cover all browsers regardless of their behavior and ensure third party cookies continue to work as before.
Alternatively at the time of sending the Set-Cookie
encabezado, puede optar detectar el client a través de la cadena de user agent. Refer to
list of incompatible clients
and then make use of an appropriate library for your platform, as an example
ua-parser-js library in Node.js. It's a good idea to find a library to handle user agent detection, since you probably don't want to write those regular expressions yourself.
The benefit of this approach is that you only need to make one change at cookie setting time. However, the necessary caveat here is that user agent tracing is inherently fragile and may not catch all affected users.
Independientemente de la opción que elija, es recomendable asegurarse de tener una forma de registrar los niveles de traffic que pasan por la ruta heredada. Asegúrese de tener un recordatorio o alerta para borrar esta solución una vez que esos niveles caigan por debajo de un umbral aceptable para su sitio.
support for SameSite=None
in languages, libraries and frameworks
Most languages and libraries support the SameSite
attribute for cookies, however, adding SameSite=None
It's relatively new, which means you may need to fix some of the standard behavior by now. These are documented in the
SameSite
repository examples on GitHub.
Getting help
Cookies are everywhere and it's rare for a site to have fully audited where they are set and used, especially once you add cross-site use cases. When you run into an obstacle, it may be the first time someone has encountered it, so don't hesitate to reach out:
Cookie Hero Image by
cayla1
in
Unsplash