Browser security
Compatibility & evidence
Browser privacy

SameSite cookies

Restricts when cookies are attached to cross-site requests.

Support in current browsers

Checked against the current browser versions recorded in MDN browser data 8.1.5.

BrowserMinimumOutcomeReason
Chrome155WorksEvery required mapped BCD feature is available without a recorded qualification.
Edge154WorksEvery required mapped BCD feature is available without a recorded qualification.
Firefox157WorksEvery required mapped BCD feature is available without a recorded qualification.
Safari27Works with limitsEvery required mapped feature is available, but BCD records one or more qualifications.
Chrome for Android155WorksEvery required mapped BCD feature is available without a recorded qualification.
Firefox for Android157WorksEvery required mapped BCD feature is available without a recorded qualification.
Safari on iOS27WorksEvery required mapped BCD feature is available without a recorded qualification.
Android WebView155WorksEvery required mapped BCD feature is available without a recorded qualification.
Samsung Internet30.0WorksEvery required mapped BCD feature is available without a recorded qualification.
The release trace

How support changed

Each segment groups recorded releases with the same result. Gaps between recorded versions are not filled in. This is support at each release, rather than the planner’s check of every release above a minimum.

Chrome

http.headers.Set-Cookie.SameSite
  1. 1 – 5050 recorded releases
    Not supported
  2. 51 – 155104 recorded releases
    Works

Edge

http.headers.Set-Cookie.SameSite
  1. 12 – 154 recorded releases
    Not supported
  2. 16 – 15478 recorded releases
    Works

Firefox

http.headers.Set-Cookie.SameSite
  1. 1 – 5962 recorded releases
    Not supported
  2. 60 – 15798 recorded releases
    Works

Safari

http.headers.Set-Cookie.SameSite
  1. 1 – 11.119 recorded releases
    Not supported
    • Safari 13 on macOS 10.14 (Mojave), treats <code>SameSite=None</code> and invalid values as <code>Strict</code>. This is fixed in version 10.15 (Catalina) and later.
    • Partial implementation
    • Treats <code>SameSite=None</code> and invalid values as <code>Strict</code> in macOS before 10.15 Catalina. See <a href="https://webkit.org/b/198181">bug 198181</a>.
  2. 12 – 12.12 recorded releases
    Works with limits
    • Partial implementation
    • Treats <code>SameSite=None</code> and invalid values as <code>Strict</code> in macOS before 10.15 Catalina. See <a href="https://webkit.org/b/198181">bug 198181</a>.
  3. 13 – 2740 recorded releases
    Works with limits
    • Safari 13 on macOS 10.14 (Mojave), treats <code>SameSite=None</code> and invalid values as <code>Strict</code>. This is fixed in version 10.15 (Catalina) and later.

Chrome for Android

http.headers.Set-Cookie.SameSite
  1. 18 – 5027 recorded releases
    Not supported
  2. 51 – 155104 recorded releases
    Works

Firefox for Android

http.headers.Set-Cookie.SameSite
  1. 4 – 5953 recorded releases
    Not supported
  2. 60 – 15788 recorded releases
    Works

Safari on iOS

http.headers.Set-Cookie.SameSite
  1. 1 – 1217 recorded releases
    Not supported
    • Partial implementation
    • Treats <code>SameSite=None</code> and invalid values as <code>Strict</code> in iOS before 13. See <a href="https://webkit.org/b/198181">bug 198181</a>.
  2. 12.21 recorded release
    Works with limits
    • Partial implementation
    • Treats <code>SameSite=None</code> and invalid values as <code>Strict</code> in iOS before 13. See <a href="https://webkit.org/b/198181">bug 198181</a>.
  3. 13 – 2740 recorded releases
    Works

Android WebView

http.headers.Set-Cookie.SameSite
  1. 1 – 5022 recorded releases
    Not supported
  2. 51 – 155104 recorded releases
    Works

Samsung Internet

http.headers.Set-Cookie.SameSite
  1. 1.0 – 4.29 recorded releases
    Not supported
  2. 5.0 – 30.043 recorded releases
    Works

BCD 8.1.5 · catalogue 2.3.0. Source corrections can change this trace without a new browser release.

What this feature can and cannot do

Helps protect against

  • Cross-site request forgery
  • Unnecessary cross-site cookie exposure

Does not guarantee

  • Same-site request forgery
  • Cross-site scripting
  • Authentication and authorisation design

What you need before using it

  • Explicit cookie classification
  • Secure transport for SameSite=None

Fallback to keep in place

Use CSRF tokens, origin validation, Secure cookies, and ordinary authorisation checks.