Skip to content

Spec says we send SameSite=Strict cookies #609

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
cbiesinger opened this issue May 30, 2024 · 2 comments
Closed

Spec says we send SameSite=Strict cookies #609

cbiesinger opened this issue May 30, 2024 · 2 comments

Comments

@cbiesinger
Copy link
Collaborator

The last paragraph of https://fedidcg.github.io/FedCM/#browser-api says:

For fetches that are sent with cookies, unpartitioned cookies are included, as if the resource was loaded as a same-origin request, e.g. regardless of the SameSite value (which is used when a resource loaded as a third-party, not first-party).

This no longer matches the CG consensus or the implementation; we only allow SameSite=None cookies. (#587 might change it to also allow Lax, but either way, the spec is incorrect)

@wseltzer
Copy link
Collaborator

wseltzer commented Apr 11, 2025

Discussed at 11 April meeting notes.

@cbiesinger
Copy link
Collaborator Author

This was actually fixed by @npm1 in a895902. The sentence now says:

When fetches are sent with cookies, unpartitioned SameSite=None cookies are included. It doesn’t introduce security issues on the API even when third-party cookies are otherwise disabled because the RP cannot inspect the results from the fetches on its own (i.e., the browser mediates what the RP can receive).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

3 participants