# Security: Cannot set sameSite=None in cookie settings
**URL:** https://meta.discourse.org/t/security-cannot-set-samesite-none-in-cookie-settings/146147
**Category:** Feature
**Tags:** pr-welcome
**Created:** [March 30, 2020, 2:12pm UTC](https://meta.discourse.org/t/security-cannot-set-samesite-none-in-cookie-settings/146147 "2020-03-30T14:12:42Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@dave0688](https://meta.discourse.org/u/dave0688)
#### Post date: [March 30, 2020, 2:12pm UTC](https://meta.discourse.org/t/security-cannot-set-samesite-none-in-cookie-settings/146147/1 "2020-03-30T14:12:42Z")
Google recently changed their cookie policies ([Chrome's Changes Could Break Your App: Prepare for SameSite Cookie Updates | Heroku](https://blog.heroku.com/chrome-changes-samesite-cookie)). Basically all cookies which come from another top level domain must have the attribute “secure: true” (which is the case), plus “sameSite=None”.
Now, in the Discourse Security settings you can change the cookie policy:
“same site cookies” with the options: “Lax”, “Strict”, “Disabled”.
The first two will be directly forwarded as values of the “SameSite” parameter in the cookie. “Disabled” does not set a value at all.
Now the problem is, that we need to pass a value “ **None** ” into the cookie. Only with “None” the cookie will be transferred to the other (non-same toplevel-domain) site.
However, there’s no value “None” which I can select in discourse - but we desperately need it to make our discourse forum API work.
It should be no big hassle to implement an additional value “None” in the same\_site cookie.
Can someone please have a look?
Thanks in advance!
David
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [March 30, 2020, 10:41pm UTC](https://meta.discourse.org/t/security-cannot-set-samesite-none-in-cookie-settings/146147/2 "2020-03-30T22:41:37Z")
PR totally welcome here to add that extra setting, it should be a tiny tiny change.
---
### Author:  [@dave0688](https://meta.discourse.org/u/dave0688)
#### Post date: [March 31, 2020, 7:54am UTC](https://meta.discourse.org/t/security-cannot-set-samesite-none-in-cookie-settings/146147/3 "2020-03-31T07:54:32Z")
No problem. Implementation (which is basically adding one word) is ready. I just signed your Contributor Agreement. Can you please make me contributor? My github name is also dave0688. Then I’ll create a PR which I would ask you (or someone else) to review please.
---
### Author:  [@dave0688](https://meta.discourse.org/u/dave0688)
#### Post date: [April 7, 2020, 1:34pm UTC](https://meta.discourse.org/t/security-cannot-set-samesite-none-in-cookie-settings/146147/4 "2020-04-07T13:34:45Z")
Can I please have an answer on that? I’m ready to create the PR, but getting a 403 when pushing my branch…
---
### Author:  [@david](https://meta.discourse.org/u/david)
#### Post date: [April 7, 2020, 1:38pm UTC](https://meta.discourse.org/t/security-cannot-set-samesite-none-in-cookie-settings/146147/5 "2020-04-07T13:38:50Z")
You will need to fork the repository, push your branch to your fork, and then make a PR from there. Only the Discourse team are ‘contributors’ to the discourse/discourse repository.
> **[Fork a repository - GitHub Docs](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/fork-a-repo)**
>
> A fork is a new repository that shares code and visibility settings with the original upstream repository.
---
### Author:  [@dave0688](https://meta.discourse.org/u/dave0688)
#### Post date: [April 7, 2020, 2:19pm UTC](https://meta.discourse.org/t/security-cannot-set-samesite-none-in-cookie-settings/146147/6 "2020-04-07T14:19:33Z")
No problem, just did that:
[https://github.com/discourse/discourse/pull/9374](https://github.com/discourse/discourse/pull/9374)
---
### Author:  [@david](https://meta.discourse.org/u/david)
#### Post date: [April 8, 2020, 9:04am UTC](https://meta.discourse.org/t/security-cannot-set-samesite-none-in-cookie-settings/146147/7 "2020-04-08T09:04:18Z")
Just merged, thanks for the PR @dave0688 😃
---
### Author:  [@david](https://meta.discourse.org/u/david)
#### Post date: [April 8, 2020, 5:00pm UTC](https://meta.discourse.org/t/security-cannot-set-samesite-none-in-cookie-settings/146147/8 "2020-04-08T17:00:08Z")
This topic was automatically closed after 7 hours. New replies are no longer allowed.