03-07-2025, 03:09 AM
Yes, I remember that.
What I said is that SameSite = ssoNone must be used in order to have 3rd party or cross-site cookies, and that part remains true. What I said above is also true.
Browsers keep changing their requirements every single week, literally. As I said above, ssoNone requires SECURE attribute also set, otherwise it won't work anymore (meaning, it used to work a few months ago, but someone in W3C, Google, Mozilla Foundation, whatever, decided that now they want it to work and behave differently).
SECURE attribute requires HTTPS (it won't work in HTTP, another "standard" requirement).
Putting everything together we have: SameSite = ssoNone only works with SECURE + HTTPS.
Not even testing in localhost it won't work if using HTTP. Painful, I know, but we don't have any control over this.
I'll run your test application and see if there is something else at play, but everything that I responded before and now stands.
What I said is that SameSite = ssoNone must be used in order to have 3rd party or cross-site cookies, and that part remains true. What I said above is also true.
Browsers keep changing their requirements every single week, literally. As I said above, ssoNone requires SECURE attribute also set, otherwise it won't work anymore (meaning, it used to work a few months ago, but someone in W3C, Google, Mozilla Foundation, whatever, decided that now they want it to work and behave differently).
SECURE attribute requires HTTPS (it won't work in HTTP, another "standard" requirement).
Putting everything together we have: SameSite = ssoNone only works with SECURE + HTTPS.
Not even testing in localhost it won't work if using HTTP. Painful, I know, but we don't have any control over this.
I'll run your test application and see if there is something else at play, but everything that I responded before and now stands.