You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
For fetches that are sent with cookies, unpartitioned cookies are included, as if the resource was loaded as a same-origin request, e.g. regardless of the SameSite value (which is used when a resource loaded as a third-party, not first-party).
This no longer matches the CG consensus or the implementation; we only allow SameSite=None cookies. (#587 might change it to also allow Lax, but either way, the spec is incorrect)
The text was updated successfully, but these errors were encountered:
This was actually fixed by @npm1 in a895902. The sentence now says:
When fetches are sent with cookies, unpartitioned SameSite=None cookies are included. It doesn’t introduce security issues on the API even when third-party cookies are otherwise disabled because the RP cannot inspect the results from the fetches on its own (i.e., the browser mediates what the RP can receive).
The last paragraph of https://fedidcg.github.io/FedCM/#browser-api says:
This no longer matches the CG consensus or the implementation; we only allow SameSite=None cookies. (#587 might change it to also allow Lax, but either way, the spec is incorrect)
The text was updated successfully, but these errors were encountered: