Subject: [httpwg/http-extensions] Setting samesite cookies when not same site context (#594)

From: HTTP issue updates <[email-masked]>
Date: Wed, 25 Apr 2018 13:11:40 -0700

What happens when a page tries to set a samesite cookie when we are not in a samesite context? For instance, a top-level a.com has an iframe to b.com and b.com tries to set a cookie with the samesite attribute. It sounds like we would want the cookie to not be writeable since it's not readable in that case.

cc @mikewest

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/594

---

From: HTTP issue updates <[email-masked]>
Date: Thu, 26 Apr 2018 00:37:43 -0700

In Firefox, we [prevent same-site cookies from being set in a third-party context](https://bugzilla.mozilla.org/show_bug.cgi?id=1452496).

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/594#issuecomment-384543813