Allowing SameSite=None Cookies in First-Party Sandboxed Contexts #450
Description
WebKittens
Title of the proposal
Allowing SameSite=None Cookies in First-Party Sandboxed Contexts
URL to the spec
URL to the spec's repository
https://github.com/whatwg/html
Issue Tracker URL
No response
Explainer URL
https://github.com/explainers-by-googlers/csp-sandbox-allow-same-site-none-cookies
TAG Design Review URL
Mozilla standards-positions issue URL
mozilla/standards-positions#1165
WebKit Bugzilla URL
No response
Radar URL
No response
Description
When third-party cookies (3PC) are blocked by Chrome and Firefox, contexts with the Content-Security-Policy: sandbox header or <iframe> sandbox attribute are no longer able to use SameSite=None cookies. The frame must include the allow-same-origin value to use cookies, which relaxes many security protections including the opaque origin.
We want to restore existing behavior and enable a frame to signal the browser to include SameSite=None cookies in first-party requests from sandboxed frames when 3PC restrictions are active with the allow-same-site-none-cookies value