fix: Set cookie to SameSite: Lax (#817)

See https://web.dev/articles/samesite-cookies-explained#explicitly_state_cookie_usage_with_the_samesite_attribute for the rationale behind this. Fixes #527 Fixes #811
amannn · Jan 25, 2024 · 0e91e64 · 0e91e64 · vercel · Jan 25, 2024
1 parent 81724a8
commit 0e91e64
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/examples/example-app-router/tests/main.spec.ts b/examples/example-app-router/tests/main.spec.ts
@@ -66,7 +66,7 @@ it('sets a cookie', async ({page}) => {
   const value = await response?.headerValue('set-cookie');
   expect(value).toContain('NEXT_LOCALE=en;');
   expect(value).toContain('Path=/;');
-  expect(value).toContain('SameSite=strict');
+  expect(value).toContain('SameSite=lax');
   expect(value).toContain('Max-Age=31536000;');
   expect(value).toContain('Expires=');
   expect(await getCookieValue()).toBe('NEXT_LOCALE=en');

diff --git a/packages/next-intl/src/shared/constants.tsx b/packages/next-intl/src/shared/constants.tsx
@@ -2,7 +2,7 @@
 // https://nextjs.org/docs/advanced-features/i18n-routing#leveraging-the-next_locale-cookie
 export const COOKIE_LOCALE_NAME = 'NEXT_LOCALE';
 export const COOKIE_MAX_AGE = 31536000; // 1 year
-export const COOKIE_SAME_SITE = 'strict';
+export const COOKIE_SAME_SITE = 'lax';
 
 export const COOKIE_BASE_PATH_NAME = 'NEXT_INTL_BASE_PATH';