Windows 10 reached EOS (end of support) on October 14, 2025. If you are on Windows 10, see this article.

Avatar for Username

Search Support

Avoid support scams. We will never ask you to call or text a phone number or share personal information. Please report suspicious activity using the “Report Abuse” option.

Learn More

SameSite flag no longer default?

  • 7 uphendule
  • 0 zinale nkinga
  • 17 views
  • Igcine ukuphendulwa ngu Denys

nothing to see here
nothing to see here

Hi,

I noticed that in the latest release (I tried both MacOS and Windows 11 ARM versions) that the "network.cookie.sameSite.laxByDefault" is no longer enabled, and cookies set by applications without specifying the flag, are not set with Lax and are sent in cross-origin requests. Could you clarify if this is intentional and why the change has been made?

Thanks

Hi, I noticed that in the latest release (I tried both MacOS and Windows 11 ARM versions) that the "network.cookie.sameSite.laxByDefault" is no longer enabled, and cookies set by applications without specifying the flag, are not set with Lax and are sent in cross-origin requests. Could you clarify if this is intentional and why the change has been made? Thanks
Ama-screenshot ananyekiwe

Isisombululo esikhethiwe

It was disabled much longer for me. They didn't plan to ship laxByDefault since 2024.

I don't think that something has been changed about it in 149.

Funda le mpendulo ngokuhambisana nalesi sihloko 👍 1

All Replies (7)

nothing to see here
nothing to see here Umnikazi wombuzo

Version 149.0 by the way

TyDraniu
TyDraniu
  • Top 10 Contributor

Isisombululo Esikhethiwe

It was disabled much longer for me. They didn't plan to ship laxByDefault since 2024.

I don't think that something has been changed about it in 149.

nothing to see here
nothing to see here Umnikazi wombuzo

Any reference on the rollback from defaulting to Lax? I can easily find that it was defaulted to Lax around 2020 or 2021, but can't find any reference or announcement around not being the default any longer. Most of the peers I deal with assumed and thought Firefox still defaulted, so FYI

TyDraniu
TyDraniu
  • Top 10 Contributor

https://bugzilla.mozilla.org/show_bug.cgi?id=1812297

cor-el
cor-el
  • Top 25 Contributor
  • Moderator

See also:

(please do not comment in bug reports
https://bugzilla.mozilla.org/page.cgi?id=etiquette.html)

nothing to see here
nothing to see here Umnikazi wombuzo

Bit different from this type of announcement https://hacks.mozilla.org/2020/08/changes-to-samesite-cookie-behavior/

Anyway.... Thanks for the clarification

Denys
Denys
  • Moderator
  • Top 10 Contributor

Hi,

Since the answer appears to be found, I've marked TyDraniu's reply above as a solution to highlight it for other users. If you disagree, you can click the Undo button under it and then mark any other reply as a solution,

Buza umbuzo

You must log in to your account to reply to posts. Please start a new question, if you do not have an account yet.