"sameSite" Problem

[alfkoblischke]

Hi Wruczek,
the plugin is great, but I have a small problem regarding the "sameSite" attribute. In Firefox it says
that the "sameSite" attribute is "none" oder mnot guilty without a "secure"-attribute. Can you help.
regards Alf

[Wruczek]

Hi there, can you explain why would you need a same-site attribute on a cookie alert? I dont think its needed.

[alfkoblischke]

Hi Wruczek, I get this Warning in Firefox: Das Cookie “acceptCookies” wird in Zukunft bald abgelehnt werden, da es für das Attribut "sameSite" entweder "none" oder einen ungültigen Wert angibt, ohne das "secure"-Attribut zu verwenden. Weitere Informationen zum "sameSite"-Attribut finden Sie unter https://developer.mozilla.org/docs/Web/HTTP/Headers/Set-Cookie/SameSite After I have accepted the cookies… And I don’t like warnings… Regards Alf Von: Wruczek <notifications@github.com> Gesendet: Mittwoch, 24. Juni 2020 00:05 An: Wruczek/Bootstrap-Cookie-Alert <Bootstrap-Cookie-Alert@noreply.github.com> Cc: alfkoblischke <alf@koblischke.com>; Author <author@noreply.github.com> Betreff: Re: [Wruczek/Bootstrap-Cookie-Alert] "sameSite" Problem (#14) Hi there, can you explain why would you need a same-site attribute on a cookie alert? I dont think its needed. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#14 (comment)> , or unsubscribe <https://github.com/notifications/unsubscribe-auth/AECA5VEZOTD3TAZ4FTT45T3RYERHZANCNFSM4OE4EM2A> . <https://github.com/notifications/beacon/AECA5VHZ5JZG2JRI6MDQ3WLRYERHZA5CNFSM4OE4EM2KYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOE2TJP2I.gif>

[duydao]

@Wruczek Maybee this explanation will help: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite#Cookies_without_SameSite_default_to_SameSiteLax

Basically, there is a change comming to browsers on how cookies are handled. If we don't add the SameSite property, it will default to lax and give a warning to the console. Apps that will rely on accessing cookies from 3rd party pages will break either way, it doesn't matter if we add it or not. This change is applied with the current version of chrome, firefox will follow.