title: How to work with cookies in Safari following their Prevent cross-site tracking option
body: <p>I noticed that when <code>Prevent cross-site tracking</code> is checked in Safari, I am unable to set the secure cookies.  I described this issue in great detail in this <a href="https://stackoverflow.com/questions/63364879/secure-cookies-not-being-set">question</a>.</p>
  <p>Then how do you set the secure cookies in Express with that setting enabled?</p>
  <p><a href="https://i.stack.imgur.com/i6YdM.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/i6YdM.png" alt="enter image description here" /></a></p>
  <p>From <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite" rel="nofollow noreferrer">MDN</a>:</p>
  <pre><code>Values
  
  The SameSite attribute accepts three values:
  
  Lax
  Cookies are allowed to be sent with top-level navigations and will be sent along with GET request initiated by third party website. This is the default value in modern browsers.
  
  Strict
  Cookies will only be sent in a first-party context and not be sent along with requests initiated by third party websites.
  
  None
  Cookies will be sent in all contexts, i.e sending cross-origin is allowed.
  
  None used to be the default value, but recent browser versions made Lax the default value to have reasonably robust defense against some classes of cross-site request forgery (CSRF) attacks.
  
  None requires the Secure attribute in latest browser versions. See below for more information.
  </code></pre>
  <hr />
  <p>It says in this <a href="https://www.theverge.com/2020/3/24/21192830/apple-safari-intelligent-tracking-privacy-full-third-party-cookie-blocking" rel="nofollow noreferrer">article</a> that Apple is phasing out third party cookies with Safari.  I'm reading online that third party cookies are generated by a different domain than the one user is visiting, for cross-site tracking, retargeting, and ad-serving.</p>
  <p>I am working on a project where the frontend is served on Netlify and the backend is from Heroku.  Since the backend has a different domain than the front-end, the cookies generated from the node express backend are considered Third-party cookies?</p>
  <p>Does that mean that I should have both frontend and backend on the same server going forward following this security practice?</p>