# Security: Cannot set sameSite=None in cookie settings

**URL:** <https://meta.discourse.org/t/security-cannot-set-samesite-none-in-cookie-settings/146147>\
**Category:** Feature\
**Tags:** pr-welcome\
**Created:** [30 במרץ,‏ 2020,‏ 2:12pm UTC](https://meta.discourse.org/t/security-cannot-set-samesite-none-in-cookie-settings/146147 "2020-03-30T14:12:42Z")\
**Posts on this page:** 1\
**Showing post:** 1

<div class="post-metadata">

**Author:** ![dave0688](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/dave0688/32/180295_2.png) [@dave0688](https://meta.discourse.org/u/dave0688)\
**Post date:** [30 במרץ,‏ 2020,‏ 2:12pm UTC](https://meta.discourse.org/t/security-cannot-set-samesite-none-in-cookie-settings/146147/1 "2020-03-30T14:12:42Z")

</div>

Google recently changed their cookie policies ([Chrome's Changes Could Break Your App: Prepare for SameSite Cookie Updates | Heroku](https://blog.heroku.com/chrome-changes-samesite-cookie)). Basically all cookies which come from another top level domain must have the attribute “secure: true” (which is the case), plus “sameSite=None”.  
Now, in the Discourse Security settings you can change the cookie policy:

“same site cookies” with the options: “Lax”, “Strict”, “Disabled”.

The first two will be directly forwarded as values of the “SameSite” parameter in the cookie. “Disabled” does not set a value at all.

Now the problem is, that we need to pass a value “ **None** ” into the cookie. Only with “None” the cookie will be transferred to the other (non-same toplevel-domain) site.

However, there’s no value “None” which I can select in discourse - but we desperately need it to make our discourse forum API work.

It should be no big hassle to implement an additional value “None” in the same\_site cookie.  
Can someone please have a look?

Thanks in advance!  
David

---

_[View the full topic](https://meta.discourse.org/t/security-cannot-set-samesite-none-in-cookie-settings/146147)._