Re: [w3ctag/design-reviews] `SameSite=Lax` by default. (#373)

Blink: [Intent to implement an ship: Cookies with SameSite by default](https://groups.google.com/a/chromium.org/d/msg/blink-dev/AknSSyQTGYs/SSB1rTEkBgAJ)

Note that SameSite=None is currently [treated as Strict](https://bugs.webkit.org/show_bug.cgi?id=198181#c10) in iOS / MacOS. I have [argued](https://groups.google.com/a/chromium.org/d/msg/blink-dev/AknSSyQTGYs/O2BHDeO4BAAJ) that I don't think we can reasonably ship this in blink as a result (don't want to force developers to rely on UA sniffing). If the CFNetwork fix (rdar://problem/42290578) got back-ported to iOS 12 then that would probably address my concern. Alternately, a different design using a new token (instead of SameSite) could address the adoption concern. @hober this is the issue I mentioned at the CSSWG meeting last week.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3ctag/design-reviews/issues/373#issuecomment-500582585

Received on Monday, 10 June 2019 20:31:48 UTC