W3cubDocs

'SameSite' cookie attribute

Same-site cookies ("First-Party-Only" or "First-Party") allow servers to mitigate the risk of CSRF and information leakage attacks by asserting that a particular cookie should only be sent with requests initiated from the same registrable domain.

Spec	https://tools.ietf.org/html/draft-ietf-httpbis-rfc6265bis-07
Status	Other

IE	Edge	Firefox	Chrome	Safari	Opera
		147	144 ⁽³⁾
		146	143 ⁽³⁾	TP
		145	142 ⁽³⁾	26.1
11 ^(1,2)	141 ⁽³⁾	144	141 ⁽³⁾	26.0	122 ⁽³⁾
10	140 ⁽³⁾	143	140 ⁽³⁾	18.5-18.6	121 ⁽³⁾
9	139 ⁽³⁾	142	139 ⁽³⁾	18.4	120 ⁽³⁾
8	138 ⁽³⁾	141	138 ⁽³⁾	18.3	119 ⁽³⁾
Show all
7	137 ⁽³⁾	140	137 ⁽³⁾	18.2	118 ⁽³⁾
6	136 ⁽³⁾	139	136 ⁽³⁾	18.1	117 ⁽³⁾
5.5	135 ⁽³⁾	138	135 ⁽³⁾	18.0	116 ⁽³⁾
	134 ⁽³⁾	137	134 ⁽³⁾	17.6	115 ⁽³⁾
	133 ⁽³⁾	136	133 ⁽³⁾	17.5	114 ⁽³⁾
	132 ⁽³⁾	135	132 ⁽³⁾	17.4	113 ⁽³⁾
	131 ⁽³⁾	134	131 ⁽³⁾	17.3	112 ⁽³⁾
	130 ⁽³⁾	133	130 ⁽³⁾	17.2	111 ⁽³⁾
	129 ⁽³⁾	132	129 ⁽³⁾	17.1	110 ⁽³⁾
	128 ⁽³⁾	131	128 ⁽³⁾	17.0	109 ⁽³⁾
	127 ⁽³⁾	130	127 ⁽³⁾	16.6	108 ⁽³⁾
	126 ⁽³⁾	129	126 ⁽³⁾	16.5	107 ⁽³⁾
	125 ⁽³⁾	128	125 ⁽³⁾	16.4	106 ⁽³⁾
	124 ⁽³⁾	127	124 ⁽³⁾	16.3	105 ⁽³⁾
	123 ⁽³⁾	126	123 ⁽³⁾	16.2	104 ⁽³⁾
	122 ⁽³⁾	125	122 ⁽³⁾	16.1	103 ⁽³⁾
	121 ⁽³⁾	124	121 ⁽³⁾	16.0	102 ⁽³⁾
	120 ⁽³⁾	123	120 ⁽³⁾	15.6	101 ⁽³⁾
	119 ⁽³⁾	122	119 ⁽³⁾	15.5	100 ⁽³⁾
	118 ⁽³⁾	121	118 ⁽³⁾	15.4	99 ⁽³⁾
	117 ⁽³⁾	120	117 ⁽³⁾	15.2-15.3	98 ⁽³⁾
	116 ⁽³⁾	119	116 ⁽³⁾	15.1	97 ⁽³⁾
	115 ⁽³⁾	118	115 ⁽³⁾	15	96 ⁽³⁾
	114 ⁽³⁾	117	114 ⁽³⁾	14.1 ⁽⁵⁾	95 ⁽³⁾
	113 ⁽³⁾	116	113 ⁽³⁾	14 ⁽⁵⁾	94 ⁽³⁾
	112 ⁽³⁾	115	112 ⁽³⁾	13.1 ^(4,5)	93 ⁽³⁾
	111 ⁽³⁾	114	111 ⁽³⁾	13 ^(4,5)	92 ⁽³⁾
	110 ⁽³⁾	113	110 ⁽³⁾	12.1 ^(4,5)	91 ⁽³⁾
	109 ⁽³⁾	112	109 ⁽³⁾	12 ^(4,5)	90 ⁽³⁾
	108 ⁽³⁾	111	108 ⁽³⁾	11.1	89 ⁽³⁾
	107 ⁽³⁾	110	107 ⁽³⁾	11	88 ⁽³⁾
	106 ⁽³⁾	109	106 ⁽³⁾	10.1	87 ⁽³⁾
	105 ⁽³⁾	108	105 ⁽³⁾	10	86 ⁽³⁾
	104 ⁽³⁾	107	104 ⁽³⁾	9.1	85 ⁽³⁾
	103 ⁽³⁾	106	103 ⁽³⁾	9	84 ⁽³⁾
	102 ⁽³⁾	105	102 ⁽³⁾	8	83 ⁽³⁾
	101 ⁽³⁾	104	101 ⁽³⁾	7.1	82 ⁽³⁾
	100 ⁽³⁾	103	100 ⁽³⁾	7	81 ⁽³⁾
	99 ⁽³⁾	102	99 ⁽³⁾	6.1	80 ⁽³⁾
	98 ⁽³⁾	101	98 ⁽³⁾	6	79 ⁽³⁾
	97 ⁽³⁾	100	97 ⁽³⁾	5.1	78 ⁽³⁾
	96 ⁽³⁾	99	96 ⁽³⁾	5	77 ⁽³⁾
	95 ⁽³⁾	98	95 ⁽³⁾	4	76 ⁽³⁾
	94 ⁽³⁾	97	94 ⁽³⁾	3.2	75 ⁽³⁾
	93 ⁽³⁾	96	93 ⁽³⁾	3.1	74 ⁽³⁾
	92 ⁽³⁾	95	92 ⁽³⁾		73 ⁽³⁾
	91 ⁽³⁾	94	91 ⁽³⁾		72 ⁽³⁾
	90 ⁽³⁾	93	90 ⁽³⁾		71 ⁽³⁾
	89 ⁽³⁾	92	89 ⁽³⁾		70
	88 ⁽³⁾	91	88 ⁽³⁾		69
	87 ⁽³⁾	90	87 ⁽³⁾		68
	86 ⁽³⁾	89	86 ⁽³⁾		67
	85	88	85 ⁽³⁾		66
	84	87	84 ⁽³⁾		65
	83	86	83 ⁽³⁾		64
	81	85	81 ⁽³⁾		63
	80	84	80 ⁽³⁾		62
	79	83	79		60
	18	82	78		58
	17 ⁽¹⁾	81	77		57
	16 ⁽¹⁾	80	76		56
	15	79	75		55
	14	78	74		54
	13	77	73		53
	12	76	72		52
		75	71		51
		74	70		50
		73	69		49
		72	68		48
		71	67		47
		70	66		46
		69	65		45
		68	64		44
		67	63		43
		66	62		42
		65	61		41
		64	60		40
		63	59		39
		62	58		38
		61	57		37
		60	56		36
		59	55		35
		58	54		34
		57	53		33
		56	52		32
		55	51		31
		54	50		30
		53	49		29
		52	48		28
		51	47		27
		50	46		26
		49	45		25
		48	44		24
		47	43		23
		46	42		22
		45	41		21
		44	40		20
		43	39		19
		42	38		18
		41	37		17
		40	36		16
		39	35		15
		38	34		12.1
		37	33		12
		36	32		11.6
		35	31		11.5
		34	30		11.1
		33	29		11
		32	28		10.6
		31	27		10.5
		30	26		10.0-10.1
		29	25		9.5-9.6
		28	24		9
		27	23
		26	22
		25	21
		24	20
		23	19
		22	18
		21	17
		20	16
		19	15
		18	14
		17	13
		16	12
		15	11
		14	10
		13	9
		12	8
		11	7
		10	6
		9	5
		8	4
		7
		6
		5
		4
		3.6
		3.5
		3
		2

Safari on iOS	Opera Mini	Android Browser	Blackberry Browser	Opera Mobile	Android Chrome	Android Firefox	IE Mobile	Android UC Browser	Samsung Internet	QQ Browser	Baidu Browser	KaiOS Browser
26.1
26.0	all	141	10	80 ⁽³⁾	141 ⁽³⁾	143	11	15.5	28	14.9	13.52 ⁽³⁾	3.0-3.1
18.5-18.6		4.4.3-4.4.4	7	12.1			10		27			2.5
18.4		4.4		12					26
18.3		4.2-4.3		11.5					25
Show all
18.2		4.1		11.1					24
18.1		4		11					23
18.0		3		10					22
17.6-17.7		2.3							21
17.5		2.2							20
17.4		2.1							19.0
17.3									18.0
17.2									17.0
17.1									16.0
17.0									15.0
16.6-16.7									14.0
16.5									13.0
16.4									12.0
16.3									11.1-11.2
16.2									10.1
16.1									9.2
16.0									8.2
15.6-15.8									7.2-7.4
15.5									6.2-6.4
15.4									5.0-5.4
15.2-15.3									4
15.0-15.1
14.5-14.8
14.0-14.4
13.4-13.7
13.3
13.2
13.0-13.1
12.2-12.5 ⁽⁵⁾
12.0-12.1 ⁽⁵⁾
11.3-11.4
11.0-11.2
10.3
10.0-10.2
9.3
9.0-9.2
8.1-8.4
8
7.0-7.1
6.0-6.1
5.0-5.1
4.2-4.3
4.0-4.1
3.2

Notes

This feature is backwards compatible. Browsers not supporting this feature will simply use the cookie as a regular cookie. There is no need to deliver different cookies to clients.

Not shipped with the initial release but later with the 2018 June security update (Patch Tuesday) to Windows 10 RS3 (2017 Fall Creators Update) and newer. More info.
Partial support because only supported in IE 11 on Windows 10 RS3 (2017 Fall Creators Update) and newer, but not in IE 11 on other Windows versions (Windows 7, ...)
Cookies without SameSite are treated as Lax by default, SameSite=None cookies without Secure are rejected.
Partial due to the lack of support in macOS before 10.14 Mojave.
Partial due to the bug that treats SameSite=None and invalid values as Strict in macOS before 10.15 Catalina and in iOS before 13.

Bugs

On Safari in macOS before 10.14.4 and iOS before 12.2, some authentication flows with a cross-site identity provider might fail when SameSite=Lax is used. See the explanation and a workaround.
On Safari before 12.1.1 and iOS before 12.3, manually visiting a redirection link to a cross-site omits Lax cookies from the cross-site request. See the bug.

Resources

Data by caniuse.com
Licensed under the Creative Commons Attribution License v4.0.
https://caniuse.com/same-site-cookie-attribute