DEV Community

Discussion on: Top 5 CORS Issues You Don't Want To Run Into

Collapse
 
chrstnfrrs profile image
Christian Farris • Edited

I spent so much time trying to figure out the last one:

A cookie associated with a cross-site resource at <url> was set without `SameSite` attribute. It has been blocked, as Chrome now delivers cookies with cross-site requests if they are set with `SameSite=none` and `Secure`

The solution you posted didn't work. We had to put an SSL certificate on the API to get everything to work.

Collapse
 
thebuildguy profile image
Tulsi Prasad

Yeah you'd have to when you're signing secure as true. In my case, SSL was by default when I deployed to Heroku so I didn't get that issue. Sorry for you! I'm still skeptic if its a boon or bane, as other browsers didn't have it on yet!