Die Funktionalität dieser Website ist durch Wartungsarbeiten eingeschränkt, die Ihr Erlebnis verbessern sollen. Wenn ein Artikel Ihr Problem nicht löst und Sie eine Frage stellen möchten, können Sie unsere Gemeinschaft über @FirefoxSupport auf Twitter, /r/firefox oder Reddit fragen.

Avatar for Username

Hilfe durchsuchen

Vorsicht vor Support-Betrug: Wir fordern Sie niemals auf, eine Telefonnummer anzurufen, eine SMS an eine Telefonnummer zu senden oder persönliche Daten preiszugeben. Bitte melden Sie verdächtige Aktivitäten über die Funktion „Missbrauch melden“.

Weitere Informationen

Dieses Thema wurde archiviert. Bitte stellen Sie eine neue Frage, wenn Sie Hilfe benötigen.

Firefox claims SameSite is set to Lax, while set-cookie contains SameSite=None and Secure

Øyvind Wergeland
Øyvind Wergeland
more options

Our backend sets a cookie for maintaining login sessions with SameSite=None and Secure (to support loading our front-end from localhost for developers and from a third party domain for PR previews).

This is the respose header:

set-cookie: ESESSIONID=<redacted>; Secure; HttpOnly; Path=/; SameSite=None; Max-Age=86399

However, Firefox does not send the cookie back with requests, but logs this error in the console:

Cookie “ESESSIONID” has been rejected because it is in a cross-site context and its “SameSite” is “Lax” or “Strict”.

We have worked around the issue by configuring exceptions in the Security & Privacy settings, but I am curious to why Firefox rejects the cookie with this error message.

Our backend sets a cookie for maintaining login sessions with SameSite=None and Secure (to support loading our front-end from localhost for developers and from a third party domain for PR previews). This is the respose header: set-cookie: ESESSIONID=<redacted>; Secure; HttpOnly; Path=/; SameSite=None; Max-Age=86399 However, Firefox does not send the cookie back with requests, but logs this error in the console: Cookie “ESESSIONID” has been rejected because it is in a cross-site context and its “SameSite” is “Lax” or “Strict”. We have worked around the issue by configuring exceptions in the Security & Privacy settings, but I am curious to why Firefox rejects the cookie with this error message.

Alle Antworten (1)

Øyvind Wergeland
Øyvind Wergeland Fragesteller
more options

I am not sure what you mean by "the site in question"? In production our back-end and front-end are served from two different subdomains of our domain, and here Firefox works with default settings.

The issue occurs when developers run the front-end from localhost (served by webpack-dev-server), and logs into our back-end. The ESSESSIONID cookie is set in the response to our callback endpoint for authorization code flow in our back-end.

It takes some effort to set up a public repro, and we are able to work around it, but I am curious to why Firefox logs an error that seems to contradict the set-cookie header.