... > So the Chrome folks plan to change that. > In Chrome 80 and later, cookies will default to SameSite=Lax. This means that cookies will automatically be s

... > So the Chrome folks plan to change that. > In Chrome 80 and later, cookies will default to SameSite=Lax. This means that cookies will automatically be sent only in a first party context unless they opt-out by explicitly setting a directive of None: Set-Cookie: ACookieAvailableCrossSite; SameSite=None; secure; httponly > This change is small in size, and huge in scope. It has huge implications for any site that expects its cookies to be used in a cross-origin context. ... > The Chrome team has set an ambitious timeline which calls for turning this feature on-by-default for Chrome 80, slated for stable release on February 4th, 2020.