As I understand it, the
SameSite attribute for cookies helps me advise standard browsers what they can do with them.
So if I'm a server running on http://acme.com/my-app and I've set a cookie like:
Set-Cookie: JSESSIONID=1234567890abcdef; SameSite=Strict
If the user is on https://www.facebook.com, the browser will stop it from sending me requests with the cookie
JSESSIONID (for fear of them executing malicious code).
If I want my cookie to be used for cross-site requests I need to set
None (which used to be default but is now
However, browsers also require that cookies with this attribute also have the attribute
Secure (example from the docs):
Set-Cookie: flavor=choco; SameSite=None; Secure
What I don't understand is why. I understand why SSL connections are more secure and why we would prefer both SSL and the attributes
Secure for our cookies where possible.
But why enforce
Secure only for cross-site cookies and not for all cookies? It obviously doesn't prevent any website using the cookie to execute requests (that's what
SameSite is for). So https://evil-evil.com can just as easily send me the user's
SameSite=None cookies as https://facebook.com. Sure, we prevent snooping and third-party monitoring (man-in-the-middle), but we also have that problem for
SameSite=Strict cookies. I.e. the bad people can still steal the cookies I send over the insecure http://acme.com/my-app/perform-sensitive-action.
So why enforce
Secure for some types of cookies except that Google said so?