ReadMeFeed / Community knowledge
Real questions. Useful conversations. Find the people who know your stack.
Chrome 80 made SameSite=Lax the default for cookies without an explicit attribute, blocking them in unsafe cross‑site POSTs. Learn how to detect the change, update cookies with SameSite=None; Secure, and verify the fix in DevTools.
A decision guide for picking SameSite=Lax, Strict, or None for cross-site cookies in Chrome, with a comparison table, explicit Set-Cookie examples, and DevTools validation steps.
Chrome defaults cookies to SameSite=Lax. This guide compares Lax, Strict, and None; Secure, explaining the CSRF trade-offs and how to verify cookie attributes in DevTools.
Goal Ensure that a single‑page application hosted on a subdomain can maintain an authenticated session after upgrading Ory Kratos from v0.10.5 to v0.11+, while the service runs on PostgreSQL 12+. Constraints and uncertainty Kratos v0.11+ sets the session cookie with SameSite=None and a new name ending in an underscore (ory_kratos_session_). Browsers only hon
Goal: Verify if Chrome’s SameSite=None; Secure requirement is enforced for cookies set by service‑worker‑generated fetch requests that target a different origin. Context: The SameSite=None; Secure rule is documented for all request types, but it is unclear whether the enforcement applies when the Set‑Cookie header originates from a service worker rather than
Cloudflare Load Balancing introduced cookie-based Session Affinity in version 1.3.0, generating an edge-managed _cf_affinity cookie to route subsequent requests to the same origin. The documented behavior indicates that Cloudflare does not propagate SameSite or Secure attributes from the origin’s Set-Cookie header to this affinity cookie, and the Load Balanc
SameSite default limits cross‑site POSTs in Chrome 80+ Chrome 80 and newer treat cookies without an explicit SameSite attribute as Lax . This default prevents the cookie from being sent on cross‑site POST requests, a behavior that often succeeds locally on localhost but fails on production HTTPS domains. The policy is documented in Chrome’s SameSite cookie s
chrome
cloudflare