title: document.cookie and Chrome's SameSite/Secure restrictions
body: <p>I am attempting to follow the new guidelines for Cross Site Cookies and passing the <code>SameSite=None; Secure</code> attributes with cookies as I attempt to set them in browser Javascript code.</p>
  
  <p>We are sending our SSO/Authorization javascript bundle from a separate host and domain that is supposed to set a cookie in the browser for storing the sessionToken. This cookie is then expected to be used on a browser refresh to maintain the users session.</p>
  
  <p>Since updating to Chrome 80 the cookie is no longer saved in the browser due to the following error:</p>
  
  <pre><code>A cookie associated with a cross-site resource at &lt;sso_domain&gt; was set without the
  `SameSite` attribute. It has been blocked, as Chrome now only delivers cookies with
  cross-site requests if they are set with `SameSite=None` and `Secure`. You can review 
  cookies in developer tools under Application&gt;Storage&gt;Cookies and see more details at 
  https://www.chromestatus.com/feature/5088147346030592 and https://www.chromestatus.com/feature/5633521622188032.
  </code></pre>
  
  <p>We are using js-cookie to set the cookie which uses the browsers <code>document.cookie</code> to actually create it: <a href="https://github.com/js-cookie/js-cookie/blob/master/src/api.mjs#L38" rel="nofollow noreferrer">https://github.com/js-cookie/js-cookie/blob/master/src/api.mjs#L38</a></p>
  
  <p>Initially we were not passing the <code>SameSite</code> attribute through the <code>attributes</code> param (we were passing <code>Secure</code>), but even after updating our call to js-cookie and seeing the appropriate <code>stringifiedAttributes</code> in Chrome Inspector (both <code>Secure</code> and <code>SameSite=None</code>):
  <a href="https://i.stack.imgur.com/81uoP.png" rel="nofollow noreferrer">SameSite cookie attribute in Chrome Inspector</a></p>
  
  <p>I am still seeing the error in the chrome console:
  <a href="https://i.stack.imgur.com/SCQLa.png" rel="nofollow noreferrer">error in console</a></p>
  
  <p>Operating System: OSX<br>
  Chrome version: Version 80.0.3987.149 (Official Build) (64-bit)</p>