Mozilla on Wednesday warned that an ongoing change in the way Firefox handles browser cookies may interfere with websites – and urged web developers to test their code.
The transition, backed by other browser vendors, has to do with the
SameSite attribute, which is used to declare how browsers should handle cookies.
Described in a 2016 specification, the
SameSite attribute allows web apps to state that cookies should not be sent with cross-site requests – requests from a third-party origin (domain). With three possible values –
SameSite=Strict – it provides a defense against cross-origin information leakage and cross-site request forgery attacks.
At the start of the year, Google said it had begun a gradual rollout of a change to the default behavior of the
SameSite attribute in Chrome 80 and sounded the alarm that some sites might not function properly. The change is simply that if undeclared, Chrome will assume a
SameSite value of
Lax instead of
Since web developers haven't traditionally set this attribute, the change in the default setting was expected to cause problems. The
Lax setting is only a bit more restrictive than
None, but it's enough to prevent some websites from functioning properly.
Google warns devs as it tightens Chrome cookie security: Stuff will break if you're not clued upREAD MORE
The collateral damage proved serious enough that Google temporarily reversed its
SameSite rollout in April due to the initial impact of the coronavirus pandemic. It seemed a bad idea at the time to hinder access to online healthcare resources.
Last month, Google said its
SameSite cookie enforcement in Chrome had resumed and would once again be ramping up. Its
SameSite changes are being activated for Chrome Stable channel users in versions 80 through 84, the latest release, though it's only available for an unspecified subset of users at this point.
Microsoft and Apple both support
SameSite in their browsers but neither has said much about adopting the same default handling of the attribute.
Mozilla meanwhile is moving ahead with its implementation. It activated the revised
SameSite default behavior in Firefox Nightly 75 back in February. And in conjunction with the release of Firefox Beta 79 in June, the safer
SameSite behavior has been activated for 50 per cent of beta users.
"We are changing the default value of the
SameSite attribute for cookies from
Lax," said Mike Conca, group product manager for Firefox Web Technologies at Mozilla, in a blog post. "This will greatly improve security for users. However, some web sites may depend (even unknowingly) on the old default, potentially resulting in breakage for those sites."
Reports of snafus related to
SameSite behavior, in Chrome and Firefox, have been trickling in for months. The latest issue for users of a pre-release version of Firefox (v81 on the Firefox Nightly release channel) is that GOV.UK Verify, a sign-in service for UK residents to access government services, can't process logins properly.
The Register asked the UK's Cabinet Office about this but given the time difference with our San Francisco office we don't expect an immediate response.
Other websites that have broken under the new
SameSite regime include UK mobile provider Three, Analog Devices, and Sony's PlayStation.com, to name a few. Both Chrome and Firefox maintain bug lists to track site breakage.
"There is currently no timeline to ship this feature to the release channel of Firefox," said Conca. "We want to see that the Beta population is not seeing an unacceptable amount of site breakage—indicating most sites have adapted to the new default behavior."
But since there's no clear definition of "breakage," he said, the Firefox team intends to keep an eye on various channels people use to report problems, such as Bugzilla, social media sites, and the like. ®