A cookie associated with a cross-site resource at http://auth0.com/ was set without the `SameSite` attribute

Get Help
10

Hi @tim6,

Yeah that would only work for your browser. You need to make sure you are using the latest version of the SDKs to remove warnings.

auth0-spa-js: we are now in version 1.8

Can you please confirm that you have:

  • Set your application to use sameSite=none if it uses response_mode=form_post when interacting with Auth0 (note that Chrome makes no exceptions, even for localhost )
  • Set your cookie as secure if its sameSite attribute equals None , otherwise it will be rejected by the browser. If you use HTTP for your Callback URLs, these will break if you use such cookies for binding the authorization request state/nonce. Therefore, you must either use HTTPS or set sameSite=lax .