SameSite cookies: a production deployment checklist

Chrome 80 changes the default treatment of cookies without a SameSite attribute. Authentication callbacks and embedded services need explicit intent rather than a global SameSite=None change.

Classify every cookie

Identify whether each cookie is first-party only, required after a top-level cross-site navigation or used within a third-party frame. Apply Lax or Strict where the journey permits and reserve None for a demonstrated cross-site requirement.

Pair None with Secure

Modern browsers require SameSite=None cookies to be Secure. Test HTTPS across every environment and account for older clients that misinterpret the None value, using narrowly scoped compatibility handling where support data requires it.

Exercise complete sign-in flows

Test identity-provider redirects, payment returns, embedded administration, logout and expired sessions in affected browser versions. Inspect the actual Set-Cookie headers at every hop rather than only the application configuration.