Developing on localhost with strict cookies

[dpetzev]

Hi guys,

I've read the new third-party restrictions that are about to be implemented, all sounds great, all works on our end.

But, how do we continue developing and testing our frontend locally on http://localhost when the cookie is SameSite=Secure and the backend is fronted by a CDN? Will there be some sort of flag that would enable us to do cross-site requests for development after Chrome has fully phased out third-party cookies or will they be fully blocked?

Context:

The cookie we create is associated with our customdomain.com and the frontend is communicating with AWS CloudFront where the custom domain is added as an alternate name. So the browser will just not send the cookie from localhost. Deploying a local backend is not really an option for us. And continuously deploying changes to pr-***.dev.customdomain.com just to test a small change is not great either.

Any tips or pointers on how we can continue local development?

Edit: SameSite=Strict is what I meant

[johannhof]

Hello, thanks for the question.

1. Since there's no SameSite=Secure I'm aware of, did you mean SameSite=Strict or SameSite=None; Secure?
2. Could you try unblocking via the "eye" icon on the right hand side of the URL bar to see if that unbreaks your testing?

[dpetzev]

1. Yes, I apologize. I meant SameSite=Strict
2. Currently we are not blocked, but come Q3 2024 (or whenever you guys decide to roll out fully blocking third-party cookies), will there be any way to develop on localhost sending requests to customdomain.com?

[sbingler]

Hi,

To clarify: SameSite=Strict isn't considered a third-party cookie (since it is only ever sent in a first-party context) and so it isn't affected by the third-party cookie phaseout. If your browser is on localhost then a SameSite=Strict cookie should never be sent to customdomain.com.

Any tips or pointers on how we can continue local development?

One common option is to edit the dev machine's hosts file to point your production hostname to your local server, something like 127.0.0.1 prod.customdomain.com

[dpetzev]

Hello, sorry for the late reply. A combination of adding this to the host file 127.0.0.1 local.customdomain.com, using mkcert and CloudFront Origins did the trick for us. Thank you for the help!