Bug 218002

Summary:	SameSite=Lax cookies are not sent along with fetch request from extension
Product:	WebKit	Reporter:	Rajaram Gaunker <zimbabao>
Component:	WebKit2	Assignee:	Nobody <webkit-unassigned>
Status:	NEW ---
Severity:	Major	CC:	abstractmachines, achristensen, adrian.kuehni, barteo, cbilling, katherine_cheney, m.kurz+webkitbugs, smoley, timothy, webkit-bug-importer, wilander
Priority:	P1	Keywords:	InRadar
Version:	Safari 14
Hardware:	Unspecified
OS:	Unspecified
See Also:	https://bugs.webkit.org/show_bug.cgi?id=265634

Description Rajaram Gaunker 2020-10-20 16:29:06 PDT

We are migrating a chrome WebExtension. The extension makes API calls from the popup to our domain.
We are a subscription service and expect auth-cookie to be sent along with API requests from the extension. Our auth cookies are SameSite=Lax.

Chrome and Firefox allow SameSite=Lax cookie to be sent with API calls from the extension, but Safari does not.

The expected behavior is: SameSite: Lax cookies should follow the behavior as extension in Chrome and Firefox.

Comment 1 Smoley 2020-10-22 14:07:03 PDT

Thanks for filing. For internal tracking this may be related to rdar://64303685.

Comment 2 Radar WebKit Bug Importer 2020-10-22 14:08:11 PDT

<rdar://problem/70588554>