psahni/sso_cookie_samesite.md

## sso_cookie_samesite.md

      
    Raw
  

              sso_cookie_samesite.md
            
          
    yes SameSite attribute controls the behaviour of the cookie
SameSite=None allows the cookie to be sent to 3rd party (cross site), so google knows where it is coming from.


both hold cookies of google.com (with Samesite=none and secure flag)
please notice the cookie with name NID, both have same value on youtube.com and mail.google.com
and both are Samesite=none with secure flag. And both of them issued by google.com (which is the master domain)
This behaviour is released by google chrome in 2020 in chrome version 80
The RFC for this feature came in 2016.
https://learn.microsoft.com/en-us/microsoftteams/platform/resources/samesite-cookie-update