New cross-site cookie not 'SameSite' warning in Chrome #561
Description
Hello,
I am wondering if anyone else has run into the following warning related to cross-site cookies with the latest version of Chrome. Per the documentation, Chrome version 80 will only deliver cookies set correctly. Is this something that I can fix in my application or something that we need for Google to fix?
A cookie associated with a cross-site resource at https://accounts.google.com/ was set without the
SameSiteattribute. A future release of Chrome will only deliver cookies with cross-site requests if they are set withSameSite=NoneandSecure. You can review cookies in developer tools under Application>Storage>Cookies and see more details at https://www.chromestatus.com/feature/5088147346030592 and https://www.chromestatus.com/feature/5633521622188032
To reproduce above warning, go to google's example sign-in website in chrome 77+ and view the logs the console: https://developers.google.com/identity/sign-in/web/sign-in
Metadata
Metadata
Assignees
Labels
Type
Projects
Milestone
Relationships
Development
Participants
Activity
[-]Cross-site cookie not 'SameSite' warning[/-][+]New cross-site cookie not 'SameSite' warning in Chrome[/+]paulzmuda commentedon Oct 14, 2019
Same problem even by adding
res.header("Set-Cookie", "HttpOnly;Secure;SameSite=None");to my server it seems something similar needs to be added on Google's where they are servinghttps://apis.google.com/js/api.jsUsing:
Chrome Version 77.0.3865.90 on MacOS Mojave
Jswk1 commentedon Oct 16, 2019
Same problem and also
signInmethod on auth instance fromgapi.auth2.getAuthInstance()has stopped working once I enabled this flag in current version of Chrome (Win10, 77.0.3865.120). Can anything be done about this or is this something that should be fixed onGoogleside?steveetm commentedon Oct 25, 2019
Guys, do anyone has any update on this? With chrome 78
signInsuddenly stopped working, I can't really ask users to go into chrome://flags and disable something.Also, I read the chromestatus links again, and I still think this should be enabled by default only in chrome 80, what happened?
SameSiteabacritt/angularx-social-login#215borgstrom commentedon Oct 26, 2019
cc @grant @bochunz
grant commentedon Oct 26, 2019
Will look into this Monday and report a bug to the team when I can reproduce. 🙂
EDIT: Added internal bug b/143761058 and reported to the team. I will update this GitHub issue if there are updates.
steveetm commentedon Oct 28, 2019
If you interested in a production site which is affected for sure, go to wish.com and try to login with google. Again, it is working fine if you disable those flags.
steveetm commentedon Oct 28, 2019
Sorry for being hasty there, but I can't believe it is affecting only us. Any update?
nathgilson commentedon Oct 28, 2019
@grant said he will report this bug to the team. It might not last long before it's getting fixed...
I found many apps having the same problem, but it concerns only a minority of users using the last version of chrome (cf canary deployment).
MathiasGilson commentedon Oct 30, 2019
@grant when disabling the following flags on chrome the login works
steveetm commentedon Oct 30, 2019
For me it was enough to disable 'SameSite by default cookies'.
Do you guys know if this is a bug in this lib, or Chrome 78 accidentally enabled this flag 2 releases earlier?
WJakub commentedon Nov 1, 2019
After successfully integrating Google Calendar API using gapi library yesterday, I saw my Chrome was out of date.
After updating to v78, the integration stopped working - Sign in popup showed, I could 'sign in' but after the popup closed, nothing happened in the app. No errors though!
3 hours into figuring out what I changed in my codebase, I came across this thread - turns out the 3 flags set to disabled make it work fine again.
Of course, there are warnings about it in the console, but they mention it's due to be changed in FUTURE RELEASE.
I believe this was shipped accidently in v78, however the warnings are not errors because they are yet to be updated as it was meant to ship in later version.
MathiasGilson commentedon Nov 2, 2019
@grant did you have time to look at it?
Your help would be really appreciated on this one 🤗
steveetm commentedon Nov 4, 2019
As I am still not sure whose fault is this and what is the exact issue I really don't want to rant or anything, but we decided to remove google login at this point. Don't get me wrong, it was planned to do something about the warning, but as this was only a warning to get ready this was totally unexpected. 19 days passed since the original report, you could easily say that forget this method, or something, but this lack of information is totally disappointing.
86 remaining items