DEV Community

Russell R.
Russell R.

Posted on

SameSite Cookie Header and Google Login

I was recently experimenting with Login with Google for my own websites I develop, and came across this error (and change in the way Chrome handles cookies):

https://github.com/google/google-api-javascript-client/issues/561

From what I gather, soon Chrome will no longer accept cookies without this SameSite header. However, unless you disable this (via chrome://flags) in Chrome, right now, Login with Google doesn't seem to work.

So, is Chrome configured by default to block cookies without that header, and Google's "Login with Google" API isn't sending them with this header? Is that correct? If so, what do developers need to do, if anything, or is this something only Google needs to change?

Thanks. Been wondering about this for a few days now, and it's not 100% clear what's going on.

Top comments (1)

Collapse
 
doushabao profile image
Doushabao •

Good catch on the SameSite cookie issue! This has been a common pain point.

Quick fix for development:

  • Chrome: chrome://flags/#same-site-by-default-cookies → set to "Disabled"
  • Or use --disable-features=SameSiteByDefaultCookies flag

For production:
The Google API client now supports SameSite. Make sure you're using the latest version:

// Update your gapi initialization
gapi.load('auth2', () => {
    gapi.auth2.init({
        client_id: 'YOUR_CLIENT_ID',
        cookiepolicy: 'single_host_origin',
        // Add SameSite attribute
        ux_mode: 'popup'
    });
});
Enter fullscreen mode Exit fullscreen mode

Better long-term solution:
Consider using Google's newer Identity Services library instead of the deprecated gapi.auth2. It handles SameSite cookies properly out of the box.

Has this helped resolve the login issue?