How to overcome the effect of chrome's samesite cookie update in the case of localhost?

Question

I have a website which requires authentication from another site to login. Both are different domains.

I have enabled the samesite by default cookies flag from chrome://flags. Just to check how chrome's new update effects in my website.

It is working perfectly in my deployed site. But when i try to run the same in my localhost, I am not able to login. I lost my third-party cookies.

It would be great, if someone explains the reason.

Answer 1

Unfortunately all cookies with SameSite=None must have a Secure parameter as well. Since you are unlikely to run HTTPS on your development server, this means your cookies won't work because the cookies are not sent over HTTPS.

The only workaround I am currently aware of is to check your environment, and set the cookies with SameSite=Lax for your development environment, and to SameSite=None; Secure for production.

In Express, you could use the secure parameter to check if you are running on HTTPS, and then set your cookie as follows:

const {secure} = req;
res.cookie('key', 'contents', {
  secure,
  httpOnly: true,
  sameSite: secure ? 'None' : 'Lax',
});