Session cookie SameSite=None limits in Ory Kratos v0.11

Answer

When Ory Kratos v0.11+ issues a session cookie with SameSite=None but without the Secure flag, modern browsers will reject the cookie entirely, so it is not sent on any cross‑origin request. The trailing underscore in the new cookie name (ory_kratos_session_) does not affect how browsers share cookies across subdomains; sharing is governed by the Domain and Path attributes, not the cookie’s name. Changing the name only breaks legacy frontend code that reads the old name. Deploying Kratos on PostgreSQL 12+ does not introduce any additional constraints on the cookie; the database version only affects session storage, not the cookie attributes.

Confirmed facts

• Browsers accept SameSite=None only when the cookie also has the Secure flag (HTTPS required).
• If Secure is missing, the cookie is ignored and not included in requests, regardless of SameSite value.
• Cookie name (including underscores) does not influence cross‑domain sharing; sharing depends on Domain and Path.
• Ory Kratos stores session data in the configured database (e.g., PostgreSQL) but does not add extra cookie attributes based on the DB version.
• Typical browser limits are ~4 KB per cookie and ~50 cookies per domain; exceeding these can cause silent drops, but this is unrelated to the SameSite=None flag.

Likely explanation / practical impact

• Without Secure, the session cookie is dropped, causing the SPA to appear unauthenticated when making requests from a subdomain or another origin.
• Frontend code that reads ory_kratos_session (the legacy name) will receive undefined after the upgrade because the cookie is now named ory_kratos_session_.
• Subdomain cookie sharing works if the cookie’s Domain attribute is set to a leading dot (e.g., .example.com) and the Path is /; the underscore in the name does not hinder this.
• PostgreSQL 12+ does not affect any of the above; it only stores the session payload.

Steps to resolve

1. Ensure Kratos is served over HTTPS and set secure: true in the cookie configuration.
2. Update the cookie section in config.yml (or equivalent) to:

cookie:
  same_site: none
  secure: true
  path: /
  domain: .example.com   # adjust to your base domain
  name: ory_kratos_session_   # default in v0.11+

3. If you must keep the legacy name for existing frontend code, either:
• Configure name: ory_kratos_session (without underscore) and accept that the cookie will lack the trailing underscore, or
• Update the SPA to read the new name (ory_kratos_session_).
4. Verify in browser devtools (Application → Cookies) that the session cookie shows both SameSite=None and Secure flags.
5. Test a cross‑origin request from a subdomain; the cookie should be present in the request headers.

Ask for one missing diagnostic detail only if it changes the recommendation: Are you serving Kratos over HTTPS with the Secure flag enabled?