← Back to release summary

FedCM: Credentialed requests will no longer send SameSite=Strict cookies

Category
Miscellaneous
Type
Chromium catches up
Status
Enabled by default (Chrome 125)
Intent stage
None

Summary

We recently changed FedCM to send ID assertion requests with CORS (see https://chromestatus.com/feature/5094763339710464). As a side-effect, that change also meant that we no longer send SameSite=Strict cookies to the ID assertion endpoint (we still send SameSite=None). Since it does not make sense to send a different set of cookies to the accounts endpoint and the ID assertion endpoint, this change makes them consistent. Not sending SameSite=Strict cookies is also consistent with requestStorageAccess behavior (https://developers.google.com/privacy-sandbox/3pcd/related-website-sets-integration#cookie_requirements) and cross-site requests in general.

Motivation

The motivation here is consistency with other web APIs and this change has been requested by other browser vendors. In addition, the spec was written such that SameSite=Strict cookies should already not have been sent because the origins were different.

Standards & signals

View on chromestatus.com