# How to set a set cookie in the management screen? **URL:** \ **Category:** Get Help\ **Tags:** api\ **Created:** [December 8, 2021, 6:21am UTC](https://community.auth0.com/t/how-to-set-a-set-cookie-in-the-management-screen/74453 "2021-12-08T06:21:25Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![lliuxu](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/lliuxu/32/33591_2.png) [@lliuxu](https://community.auth0.com/u/lliuxu)\ **Post date:** [December 8, 2021, 6:21am UTC](https://community.auth0.com/t/how-to-set-a-set-cookie-in-the-management-screen/74453/1 "2021-12-08T06:21:25Z")
When we tested the app made by auth0, we found that the samesite attribute was not set in the set- cookie. When getting a token, the response header has four set-cookies. The last two set-cookies are not set. We want to update them manually, but we don’t find the setting location in the management screen. Can you tell us where to set them? ---
**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\ **Post date:** [December 9, 2021, 10:29pm UTC](https://community.auth0.com/t/how-to-set-a-set-cookie-in-the-management-screen/74453/3 "2021-12-09T22:29:45Z")
Hi @lliuxu, Welcome to the Auth0 Community! This isn’t something you would typically have to set up manually. Are you running into a specific issue? Also, can you give an example (screenshot) of the cookies you are referring to? ---
**Author:** ![lliuxu](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/lliuxu/32/33591_2.png) [@lliuxu](https://community.auth0.com/u/lliuxu)\ **Post date:** [December 10, 2021, 1:14am UTC](https://community.auth0.com/t/how-to-set-a-set-cookie-in-the-management-screen/74453/4 "2021-12-10T01:14:21Z")
Thank you for your support! The samesite attribute is not set in cookie 「\_legacy\_auth0.ip\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*.is.authenticated」「\_legacy\_auth0.is.authenticated」, which seems to contain sensitive information such as session IDs. The response of my application looks like the yellow part in the screenshot below. ![2](https://global.discourse-cdn.com/auth0/original/3X/0/9/09dac3613d9f4745acb251e01bb6c61f14b9815d.jpeg) ---
**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\ **Post date:** [December 10, 2021, 5:26pm UTC](https://community.auth0.com/t/how-to-set-a-set-cookie-in-the-management-screen/74453/5 "2021-12-10T17:26:20Z")
Those are fallback cookies for browsers that don’t support same site attributes. It is clearly stated in the docs here: > **[SameSite Cookie Attribute Changes](https://auth0.com/docs/manage-users/cookies/samesite-cookie-attribute-changes)** > > Describes how browser changes, such as the SameSite cookie attribute, affects your web applications that embed content from third-party domains. ---
**Author:** ![lliuxu](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/lliuxu/32/33591_2.png) [@lliuxu](https://community.auth0.com/u/lliuxu)\ **Post date:** [December 13, 2021, 12:57am UTC](https://community.auth0.com/t/how-to-set-a-set-cookie-in-the-management-screen/74453/6 "2021-12-13T00:57:19Z")
Thankyou for your support. I also read this article, but I don’t know where and how to set it? Can you tell me? ---
**Author:** ![lliuxu](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/lliuxu/32/33591_2.png) [@lliuxu](https://community.auth0.com/u/lliuxu)\ **Post date:** [December 13, 2021, 1:20am UTC](https://community.auth0.com/t/how-to-set-a-set-cookie-in-the-management-screen/74453/7 "2021-12-13T01:20:36Z")
Thank you for your support. Our customer requires that lax be set, but none is not required. Can this be updated manually? ---
**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\ **Post date:** [December 13, 2021, 4:12pm UTC](https://community.auth0.com/t/how-to-set-a-set-cookie-in-the-management-screen/74453/8 "2021-12-13T16:12:43Z")
> [@lliuxu](#): > > Can this be updated manually? No. These cookies are set this way deliberately. ---
**Author:** ![lliuxu](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/lliuxu/32/33591_2.png) [@lliuxu](https://community.auth0.com/u/lliuxu)\ **Post date:** [December 14, 2021, 1:17am UTC](https://community.auth0.com/t/how-to-set-a-set-cookie-in-the-management-screen/74453/9 "2021-12-14T01:17:41Z")
Thank you for your support. ---
**Author:** ![lliuxu](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/lliuxu/32/33591_2.png) [@lliuxu](https://community.auth0.com/u/lliuxu)\ **Post date:** [December 14, 2021, 1:35am UTC](https://community.auth0.com/t/how-to-set-a-set-cookie-in-the-management-screen/74453/10 "2021-12-14T01:35:50Z")
Our customers now complain that there are security vulnerabilities (such as CSRF) because they do not set samesite. They want to set samesite = lax. However, this cannot be updated manually. How do you consider this? Or what solutions do you have? 「\_legacy\_auth0.ip\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*.is.authenticated」「\_legacy\_auth0.is.authenticated」 ---
**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\ **Post date:** [December 15, 2021, 8:26pm UTC](https://community.auth0.com/t/how-to-set-a-set-cookie-in-the-management-screen/74453/11 "2021-12-15T20:26:36Z")
Hi @lliuxu, Can you confirm is this in regards to the compat cookies or the .is.authenticated cookies? Or both? The compat cookies are set without samesite attributes intentionally, if I am not mistaken. ---
**Author:** ![lliuxu](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/lliuxu/32/33591_2.png) [@lliuxu](https://community.auth0.com/u/lliuxu)\ **Post date:** [December 16, 2021, 1:02am UTC](https://community.auth0.com/t/how-to-set-a-set-cookie-in-the-management-screen/74453/12 "2021-12-16T01:02:22Z")
> [@dan.woda](#): > > the .is.authenticated I have confirmed that it should be the is. authenticated.How do you consider this? Or what solutions do you have? ---
**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\ **Post date:** [December 16, 2021, 9:19pm UTC](https://community.auth0.com/t/how-to-set-a-set-cookie-in-the-management-screen/74453/13 "2021-12-16T21:19:23Z")
Thanks for providing the extra info. I am reaching out to the team and I’ll report back. ---
**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\ **Post date:** [December 16, 2021, 9:43pm UTC](https://community.auth0.com/t/how-to-set-a-set-cookie-in-the-management-screen/74453/14 "2021-12-16T21:43:09Z")
Do you have an example of how this can cause CSRF? ---
**Author:** ![lliuxu](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/lliuxu/32/33591_2.png) [@lliuxu](https://community.auth0.com/u/lliuxu)\ **Post date:** [December 17, 2021, 7:08am UTC](https://community.auth0.com/t/how-to-set-a-set-cookie-in-the-management-screen/74453/15 "2021-12-17T07:08:34Z")
Sorry, I didn’t.This is the problem pointed out by our customers. ---
**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\ **Post date:** [December 17, 2021, 5:02pm UTC](https://community.auth0.com/t/how-to-set-a-set-cookie-in-the-management-screen/74453/16 "2021-12-17T17:02:37Z")
Okay. It doesn’t look like this cookie will have that effect. Are they mistaking it for the session cookie? ---
**Author:** ![lliuxu](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/lliuxu/32/33591_2.png) [@lliuxu](https://community.auth0.com/u/lliuxu)\ **Post date:** [December 20, 2021, 12:56am UTC](https://community.auth0.com/t/how-to-set-a-set-cookie-in-the-management-screen/74453/17 "2021-12-20T00:56:27Z")
Thankyou for you support. > **Note:** `Lax` replaced `None` as the default value in order to ensure that users have reasonably robust defense against some classes of cross-site request forgery ([CSRF](https://developer.mozilla.org/en-US/docs/Glossary/CSRF)) attacks. > from: [Set-Cookie - HTTP | MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite) Our customers’ instructions are as follows: > Proper settings may prevent cross-site request forgery from running. The SameSite attribute is not set in the cookies “\_legacy\_auth0.xxxxx.is.authenticated” and “\_legacy\_auth0.is.authenticated” that seem to store sensitive information such as session ID. I now want to be able to set samesite = lax. Can you provide a solution? ---
**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\ **Post date:** [December 20, 2021, 2:52pm UTC](https://community.auth0.com/t/how-to-set-a-set-cookie-in-the-management-screen/74453/18 "2021-12-20T14:52:40Z")
It’s not possible to manually set it. The team had this to say: > We explicitly set it to `none` when saving cookies, at least for HTTPS. If no HTTPS, we use the browser default by not specifying a value at all.[https://github.com/auth0/auth0-spa-js/blob/0c6166c0f1dd7c8405b7231d0074c1eb0d8a164f/src/storage.ts#L36](https://github.com/auth0/auth0-spa-js/blob/0c6166c0f1dd7c8405b7231d0074c1eb0d8a164f/src/storage.ts#L36) > > If they’re testing on `localhost` , it could be (I’m assuming Chrome) defaulting to `lax` if the SameSite attribute is not specified. See [this Chrome feature](https://chromestatus.com/feature/5088147346030592) which started rolling out from July 2020. So it could be Chrome just reporting that default. > > When SameSite was implemented in this SDK, we decided at the time to specify `none` when running on HTTPS, and not specify anything at all (inherit browser defaults) when not running on HTTPS. Hope that helps. ---
**Author:** ![lliuxu](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/lliuxu/32/33591_2.png) [@lliuxu](https://community.auth0.com/u/lliuxu)\ **Post date:** [December 21, 2021, 1:51am UTC](https://community.auth0.com/t/how-to-set-a-set-cookie-in-the-management-screen/74453/19 "2021-12-21T01:51:19Z")
Thank you for your support. Check if there is any other way to deal with it other than “Cookie SameSite attribute not set”. ---
**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\ **Post date:** [December 21, 2021, 2:20pm UTC](https://community.auth0.com/t/how-to-set-a-set-cookie-in-the-management-screen/74453/20 "2021-12-21T14:20:37Z")
Are you running it on localhost? ---
**Author:** ![lliuxu](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/lliuxu/32/33591_2.png) [@lliuxu](https://community.auth0.com/u/lliuxu)\ **Post date:** [December 22, 2021, 1:04am UTC](https://community.auth0.com/t/how-to-set-a-set-cookie-in-the-management-screen/74453/21 "2021-12-22T01:04:06Z")
Thank you for your support. [https://xxxxxxxx.com/](https://xxxxxxxx.com/) Implemented in the environment. > **Note:** `Lax` replaced `None` as the default value in order to ensure that users have reasonably robust defense against some classes of cross-site request forgery ([CSRF](https://developer.mozilla.org/en-US/docs/Glossary/CSRF)) attacks. > from :[Set-Cookie - HTTP | MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite) ↓↓Here are the details given to us by our customers > Proper settings may prevent cross-site request forgery from running. > The SameSite attribute is not set in the cookies “\_legacy\_auth0.ip\*\*\*\*\*\*\*\*\*\*.is.authenticated” and “\_legacy\_auth0.is.authenticated” that seem to store sensitive information such as session ID. > The following values ​​can be set for the SameSite attribute. > -Strict > No longer sends cookies when crossing different domains. For example, if you have a cookie for site A and you are accessing site B and you follow the link for site A on site B, the cookie will not be sent. > -Lax > Cookies will not be sent except when transitioning across different domains and GET. For example, POST forms and requests to other domains via img, iframe, XHR, etc. do not send cookies. > -None > A cookie is also sent when transitioning from a site in another domain. > Of the above, specifying Strict or Lax is a mitigation measure against cross-site request forgery attacks. It is just a mitigation measure and cannot be completely prevented. Also, depending on the browser, the SameSite attribute may not be available. Our customers are worried about CSRF attacks if they don’t set Samesite = lax. Are you sure that the current setting (without setting samesite = LAX) will not cause security problems (e.g. CSRF)? I will report to my customers. [Next page](https://community.auth0.com/t/how-to-set-a-set-cookie-in-the-management-screen/74453.md?page=2)