SameSite attribute and Facebook SDK

Question

I am trying to solve the warning that I get from Chrome browser:

A cookie associated with a cross-site resource at http://www.facebook.com/ was set without the `SameSite` attribute. A future release of Chrome will only deliver cookies with cross-site requests if they are set with `SameSite=None` and `Secure`. You can review cookies in developer tools under Application>Storage>Cookies and see more details at https://www.chromestatus.com/feature/5088147346030592 and https://www.chromestatus.com/feature/5633521622188032. <br/>

I am using the Facebook Login web SDK. When trying to get rid of the warning I created a very simple page with no cookies. The single cookie is not created by my script but is the one from Facebook. Looks like the backend code does not really affect the cookie. It is set in the response header.

In the PHP code I have introduced this code:

$fbcook = $_COOKIE[$facebookcookiename];
setrawcookie($facebookcookiename, $fbcook, ['samesite' => 'None', 'secure' => true]);

And it takes effect, when I debug the network I see in the headers:

set-cookie: fbcookie=value; secure; SameSite=None

The raw value is base_domain=.blabla.bla

The cookie attributes in request header:

cookie: fbcookie=value

And there is the network debug info in Chrome:

I would expect this if it is set once again at facebook.com, because I see in the warning 'at http://www.facebook.com/' and not about my site blabla.bla. Is there a way to get rid of the warning? Another question: will the functionality be affected when Chrome changes the policy? I would like to do it without changing the settings of the browser. It is unlikely that users of the site will make any changes to get rid of any security fixes in the browser.

Answer 1

No, this is not something you can do anything about. This isn’t your cookie, it is one set by Facebook, valid for their domain.

Facebook has to fix this, and you can probably rest assured that they will do so in time, otherwise it will likely break login functionality on a lot of sites.