SameSite cookie blocked 🔐 Authentication

This Set-Cookie was blocked because it had the "SameSite=Lax" attribute but came from a cross-site response / SameSite=None requires Secure

The browser refused to store or send an auth/session cookie because of SameSite or Secure rules — so logins don’t “stick” across sites or iframes.

Seen on: REST API

Meaning

Cross-site requests (frontend on app.com, API on api.otherdomain.com, embedded iframes, OAuth POST callbacks) need SameSite=None; Secure cookies over HTTPS. Browsers also increasingly block third-party cookies entirely.

Common causes

  • API on a different site than the frontend with default SameSite=Lax
  • SameSite=None without Secure (or on http)
  • App embedded in an iframe on another site
  • Third-party cookie blocking (Safari, Chrome)

⚡ Quick fix

  1. Serve frontend and API on the same site (subdomains of one domain)
  2. Use SameSite=None; Secure over HTTPS when cross-site is required
  3. Prefer token-based auth for cross-site APIs

Detailed fix by platform

JavaScript

  1. res.cookie("sid", value, { httpOnly: true, secure: true, sameSite: "none", domain: ".example.com" });

How to diagnose

  1. Sites — Frontend vs API registrable domain
  2. Flags — SameSite/Secure in Set-Cookie
  3. DevTools — Cookie warnings in Network/Application

🔧 Still not fixed?

Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:

🧠 Still stuck? Analyze your error

Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.