3 ms·
Sigh. This is going to break a lot of sites—especially the less than clearly documented behavior of SameSite=Lax with iframe content. If I understand it correct
by crgwbr 7y ago
Sigh. This is going to break a lot of sites—especially the less than clearly documented behavior of SameSite=Lax with iframe content. If I understand it correctly, iframe’d content, even from the same domain as the parent frame, won’t receive any cookies set to SameSite=Lax or Strict.
Does anyone no the rational for this on non-cross domain frames?
- pg_is_a_butt 7y agoMore like this is going to change a lot of sites to include a "Best viewed in firefox" message.
- sebazzz 7y agoFor same domain requests even with iframe the cookies are sent. I'm more worried about the fact that it may break cross domain authentication, though most authentication frameworks support passing state through the authentication mechanism.