SameSite = "None" not work with secure: true

[JeRabix]

SameSite = "None" not work with secure: true,

Specify this in the documentation plz!!!
I lost 3 hours!!!

[dougwilson]

Hi @JeRabix the issue depends on which web browser and client you are using, unfortunately. There is no straight forward rules at this time to actually document. This module's readme document's the API of the module instead of trying to document every quirk with cookie handling of every client out there. The notable web browser Chrome even has a flag in the browser to change this behavior, making it that much more complicated to document. The scope of the module's readme is the module's own API.

The current cookie specification does not have the restriction where samesite cannot be none when secure is true, afaik: https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis-08