Cloudflare Load Balancing Session Affinity Cookie Method v1.3.0 Attribute Compatibility Boundary

Cloudflare Load Balancing introduced cookie-based Session Affinity in version 1.3.0, generating an edge-managed _cf_affinity cookie to route subsequent requests to the same origin. The documented behavior indicates that Cloudflare does not propagate SameSite or Secure attributes from the origin’s Set-Cookie header to this affinity cookie, and the Load Balancing settings do not currently expose controls for SameSite, Secure, or HttpOnly on the cookie itself.

This creates an unresolved compatibility boundary for applications that rely on strict cookie attribute enforcement at the edge. Because the affinity cookie is set by Cloudflare rather than the origin, the absence of configurable attributes may conflict with browser security expectations or organizational cookie policies. It remains unclear whether the current behavior is a permanent design constraint of the edge-managed cookie or a configuration gap that future versions will address, particularly when TLS termination occurs at the edge and origin headers differ from the final client-facing response.

Is the lack of configurable SameSite, Secure, and HttpOnly attributes on the _cf_affinity cookie an intentional limitation of the v1.3.0 Session Affinity implementation, or is support for edge-level cookie attribute configuration planned? How should teams evaluate whether their origin’s Set-Cookie headers influence the affinity cookie’s final attributes under different TLS termination modes? What is the current compatibility boundary between Cloudflare’s edge-managed affinity cookie and browser-enforced cookie attribute policies?