Third-party cookie blocked in Chrome

The user, or a Chrome setting, blocks third-party cookies. The page in your frame is on another site, so its cookies are third-party, and Chrome does not send or keep them.

  • Chrome
  • Firefox
  • Safari

Updated

Console error · Chrome, exact text

Third-party cookie blocked in Chrome due to Chrome flags or browser settings

ChromeExact text

The frame loads without its cookies. The Issues tab of DevTools shows a cookie issue for the blocked cookie.

Third-party cookie blocked in Chrome due to Chrome flags or browser settings

FirefoxExact text

The frame loads without its cookies.

Cookie “session” has been rejected as third-party.

SafariWhat you see

The frame loads without its cookies. Safari blocks third-party cookies by default.

On this page

What it means

Chrome did not send or keep a cookie of the page in your frame, because that page is on another site and third-party cookies are off. The page in the frame may then show a sign-in form or forget the cart. Read about cookies in iframes.

Why it happens

A cookie is third-party when the page that uses it is in a frame from another site:

  1. Chrome blocks third-party cookies in Incognito, and when the user turns on the setting to block them.

  2. Safari blocks third-party cookies by default. Firefox gives each top site its own cookie jar.

Check the page

See the headers the page sends now

Fix it if you own the site

Set the cookie with Partitioned (CHIPS). A partitioned cookie is kept only for the top site that frames the page, and Chrome allows it when third-party cookies are off. If the frame must read its first-party cookies, call document.requestStorageAccess() after a click. The cookies guide has the details.

Response header
Set-Cookie: session=abc123; Path=/; Secure; HttpOnly; SameSite=None; Partitioned

A partitioned cookie is a separate copy for each top site. A user who signs in on your site in a new tab is still signed out in the frame.

If you do not own the site

You cannot change the cookies of another site, or the settings of your visitors. Use one of these.

  1. Open the page in a new tab

    Link to the page so the user signs in on the site itself, where its cookies work.

  2. Use the official embed

    Some services give an embed that needs no login, or one that is made for frames.

  3. Ask the owner

    Ask them to set their cookie with SameSite=None, Secure and Partitioned.

Sources

Know before you embed.

Free, no sign-up, nothing stored. Paste a URL and get a verdict, a live preview, and the fix.