Session cookie SameSite=None limits in Ory Kratos v0.11

Goal

Ensure that a single‑page application hosted on a subdomain can maintain an authenticated session after upgrading Ory Kratos from v0.10.5 to v0.11+, while the service runs on PostgreSQL 12+.

Constraints and uncertainty

Kratos v0.11+ sets the session cookie with SameSite=None and a new name ending in an underscore (ory_kratos_session_). Browsers only honor SameSite=None when the Secure flag is present, which may not be set in local development over HTTP. Additionally, frontend code that reads the cookie by the legacy name will no longer receive the token after the upgrade. It is unclear whether the combination of the new cookie name, SameSite=None, and the Secure requirement imposes practical limits on cross‑origin subdomain requests in typical deployment scenarios.

• What are the effective cross‑origin request limits when Kratos v0.11+ issues a SameSite=None session cookie without the Secure flag?
• How does the trailing underscore in the cookie name affect subdomain cookie sharing when the application relies on the legacy name for token access?
• Does deploying Kratos v0.11+ on PostgreSQL 12+ introduce any additional constraints that interact with the session cookie behavior?