Cookie has been rejected because it is in a cross-site context
Firefox writes this message when a page in a frame from another site sets a cookie with SameSite=Lax or SameSite=Strict. Firefox does not keep the cookie, so the frame acts as if the user is signed out.
- Chrome
- Edge
- Firefox
Updated
Cookie “session” has been rejected because it is in a cross-site context and its “SameSite” is “Lax” or “Strict”.
The frame loads, but the cookie is not set.
Cookie “session” has been rejected because it is in a cross-site context and its “SameSite” is “Lax” or “Strict”.
The frame loads, but the cookie is not set.
This attempt to set a cookie via a "Set-Cookie" header was blocked because it had the "SameSite=Lax" attribute but came from a cross-site response which wasn’t the response to a top-level navigation
On this page
What it means
Why it happens
Check the page
See the headers the page sends now
Fix it if you own the site
Set-Cookie: session=abc123; Path=/; Secure; HttpOnly; SameSite=None; Partitioned
A cookie with SameSite=None must also have Secure, and the page must use HTTPS. Without Secure, the browser rejects the cookie.
If you do not own the site
- Open the page in a new tab
Link to the page so the user signs in on the site itself, where its cookies work.
- Use the official embed
Some services give an embed that needs no login, or one that is made for frames.
- Ask the owner
Ask them to set their cookie with SameSite=None, Secure and Partitioned.