Misleading error message "Some cookies are misusing the recommended SameSite attribute"
Categories
(Core :: Networking: Cookies, enhancement, P3)
Tracking
()
People
(Reporter: gtisza, Unassigned)
References
Details
(Whiteboard: [necko-triaged])
Steps to reproduce:
Visit some website, e.g. https://en.wikipedia.org/ (or Amazon, YouTube etc).
Actual results:
The console will probably show some warnings like
Some cookies are misusing the recommended “SameSite“ attribute
Cookie “NetworkProbeLimit” does not have a proper “SameSite” attribute value. [...]
The cookies listed under this warning don't actually use the SameSite attribute at all.
Expected results:
This is a misleadingly worded warning that results in people thinking there is an error in the web application and filing bogus bug reports. The attribute is not being misused in any way; SameSite is not a required attribute, and in for many cookies there is nothing improper about leaving it unset. I understand the importance of warning people about the upcoming browser behavior change, but that should be worded like a notification and avoid loaded words like "misuse" which implies something bad is happening.
Compare e.g. with the Chrome developer console, which categorizes these messages as "breaking change" (as opposed to "warning"), hiding them by default, and the message is more neutral:
Reading cookie in cross-site context will be blocked in future Chrome versions
Comment 1•1 year ago
|
||
Setting as new since it is an enhancement. Please update component if not correct. Thank you.
Updated•1 year ago
|
Comment 2•1 year ago
|
||
Since bug 1617609 is wontfix - I think we might want to consider removing the SameSite warning.
Updated•1 year ago
|
Description
•