rails: Cookie “_rails6_session” will be soon rejected because it has the “sameSite” attribute set to “none” or an invalid value, without the “secure” attribute.

Didn’t Google decide to revert the SameSite change? https://blog.chromium.org/2020/04/temporarily-rolling-back-samesite.html.

I think Firefox is wrong here.

While Mozilla may have bad timing, they’re not alone in wanting to make this change, and they’re not wrong.

The article also clearly states that the pause in rollout I a temporary one related to covid19.

The sameSite change is coming (just like winter).

If you generate a new application, yes. If you are updating an existing application you still need to change the cookies_same_site_protection configuration, or use the Rails 6.1 default configurations.

See https://github.com/rails/rails/blob/38998af1d9035d529e553251ae441f0c09b7e8ab/railties/lib/rails/generators/rails/app/templates/config/initializers/new_framework_defaults_6_1.rb.tt#L22-L26

Thanks for the update. I use Firefox Dev Edition for development and it was showing as a warning and I couldn’t find any reference to it elsewhere especially as it was referring to rails6_session. Yes seems its come through to latest Firefox.

That might be the case that it’s delayed, but sounds like it should still be addressed within rails, especially knowing that the changes, while delayed are still coming.

Currently, in Rails <6.1 I believe the default is to set no SameSite value. The warning arises from a specific set of browser versions which would default this to SameSite=None and warn about a potential deprecation in combining that without Secure, but in the future when actual enforcement against setting None without Secure will happen will default to Lax instead.

If we assume SameSite=Lax defaults in the browser (what Chrome and Firefox are now planning), what does closing this issue look like on the Rails side? Explicitly setting SameSite (with Lax defaults) on the Rails side is already slated for 6.1 (there’s some extensive discussion here).

I am seeing this also on the latest release of Firefox 76.0 (64-bit) Mozilla Firefox for Linux Mint - 1.0 This is not a development build

The commits which fix this are included in Rails v6.1.0.rc1. You can enable them by specifying the RC in your Gemfile:

gem 'rails', git: 'https://github.com/rails/rails.git', tag: 'v6.1.0.rc1'

Then run bundle, then rails app:update. Afterwards, set Rails.application.config.action_dispatch.cookies_same_site_protection = :lax appropriately in your config, and you shouldn’t get any browser warnings.

Explicitly setting SameSite (with Lax defaults) on the Rails side is already slated for 6.1

Awesome! AFAIK it was slated from this thread. See post 8 May. Thanks for the link to the other discussion.

I expect this thread will stay open until 6.1 is delivered or other issues arise with this.

Take a look at this recent post from Mozilla.