Cookie not sent on cross-site requests (iframe, fetch with credentials, embedded widget): 'SameSite=None; Secure' and the 'This Set-Cookie was blocked' warning

Cause: cookies without a SameSite attribute are treated as Lax by browsers. Lax cookies are sent on same-site requests and top-level navigations with safe methods, but not on cross-site subrequests such as iframes, images, fetch or XHR. A cookie that must travel on those requests needs SameSite=None, and SameSite=None is only accepted together with Secure (so the site must be served over HTTPS, localhost excepted). A cookie marked None without Secure is rejected, which is what the console warning reports. Fix: 1. First ask whether the request really is cross-site. Cookies only cross the line when the registrable domain or scheme differs. Putting frontend and API under the same site (for example app.example.com and api.example.com, or a reverse proxy path) avoids the issue and is usually more robust. 2. If cross-site is truly needed, set the cookie as: Set-Cookie: name=value; SameSite=None; Secure; HttpOnly; Path=/ . Keep HttpOnly for session cookies. 3. In JavaScript calls use fetch(url, { credentials: 'include' }), and make the server answer with Access-Control-Allow-Origin set to the exact origin (not *) and Access-Control-Allow-Credentials: true. Those CORS headers are a separate requirement from SameSite. 4. For embedded third-party content that only needs per-site state, consider the Partitioned attribute (CHIPS), which requires Secure. 5. Expect that browsers increasingly block third-party cookies entirely; do not depend on them for authentication. Prefer same-site setups or token-based flows. 6. Reserve SameSite=None for cookies that need it; use Lax or Strict for the rest to keep CSRF protection. Verify: in the browser's developer tools (Application > Cookies, and the Network panel's cookie issues) the cookie is stored with SameSite None and Secure, and shows up in the cross-site request headers. Sources: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Set-Cookie https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/Cookies