Default value of SameSite

[gsnedders]

MDN URL

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie

What specific section or headline is this issue about?

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#samesitesamesite-value

What information was incorrect, unhelpful, or incomplete?

Lax: […] This is the default behavior if the SameSite attribute is not specified.

What did you expect to see?

Something about how the default behaviour varies between browsers.

Do you have any supporting links, references, or citations?

https://bugzilla.mozilla.org/show_bug.cgi?id=1618610#c17:

We won't be shipping samesitelax by default, so all of this breakage bugs can also be closed.

https://bugzilla.mozilla.org/show_bug.cgi?id=1617609#c23:

I think we can WONTFIX this

Do you have anything more you want to share?

No response

MDN metadata

Page report details

• Folder: en-us/web/http/headers/set-cookie
• MDN URL: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie
• GitHub URL: https://github.com/mdn/content/blob/main/files/en-us/web/http/headers/set-cookie/index.md
• Last commit: 783ffd9
• Document last modified: 2024-10-08T05:47:21.000Z

[hamishwillee]

Thanks @gsnedders . MDN documents the spec and deviations from the spec are supposed to be caught by the compatibility data section. That is a policy of MDN, and is happening here:

Given Firefox is now saying this won't be adopted, I'm kind of interested to find out what, if anything, is happening to the spec https://bugzilla.mozilla.org/show_bug.cgi?id=1617609#c25
Depending on the answer I'll put the defaults for FF and iOS in the browser compat data.

Depending on the responses I may also add a note they might be different. I don't want to because the policy to put this in the browser data exists for a reason. But I can see it would be very easy to miss in this case.

[bsmth]

Depending on the responses I may also add a note they might be different

Jumping in to say +1 to adding some info in the SameSite=Lax DL, pointing to the compat data, especially given default behavior if not specified.

[hamishwillee]

FYI @bsmth is sorting this out in this bit #36862 (comment)