Set-Cookie blocked: SameSite=Lax cookie in a cross-site frame
The page in the frame tries to set a cookie with SameSite=Lax or SameSite=Strict. In a frame from another site, the browser does not keep that cookie, so a login or a cart in the frame does not work.
- Chrome
- Edge
- Firefox
Updated
This attempt to set a cookie via a "Set-Cookie" header was blocked because it had the "SameSite=Lax" attribute but came from a cross-site response which wasn’t the response to a top-level navigation
The frame loads, but the cookie is not set. DevTools shows the note in the Network panel, on the Cookies tab of the request.
This attempt to set a cookie via a "Set-Cookie" header was blocked because it had the "SameSite=Lax" attribute but came from a cross-site response which wasn’t the response to a top-level navigation
The frame loads, but the cookie is not set.
Cookie “session” has been rejected because it is in a cross-site context and its “SameSite” is “Lax” or “Strict”.
On this page
What it means
Why it happens
Check the page
See the headers the page sends now
Fix it if you own the site
Set-Cookie: session=abc123; Path=/; Secure; HttpOnly; SameSite=None; Partitioned
A cookie with SameSite=None must also have Secure, and the page must use HTTPS. Without Secure, the browser rejects the cookie.
If you do not own the site
- Open the page in a new tab
Link to the page so the user signs in on the site itself, where its cookies work.
- Use the official embed
Some services give an embed that needs no login, or one that is made for frames.
- Ask the owner
Ask them to set their cookie with SameSite=None, Secure and Partitioned.