SameSite None Without Secure

A cookie is configured with sameSite: 'none' but is not marked secure. An Express res.cookie() call (or an equivalent cookie API) sets the cross-site policy to none while secure is left false or omitted in the options object.

SameSite=None tells the browser to send the cookie on cross-site requests, re-enabling the exact behaviour that the SameSite mechanism exists to restrain. Modern browsers therefore only accept a SameSite=None cookie when it is also marked Secure; a cookie that is None without Secure is either rejected outright or, on older clients, transmitted over plain HTTP.

Omitting Secure on a cross-site cookie exposes it to interception over insecure transport and re-opens the CSRF surface that SameSite was meant to close. Session and authentication cookies configured this way can be leaked or replayed.

When a cookie must be sent cross-site (sameSite: 'none'), always set secure: true so it is only transmitted over HTTPS. If the cookie does not need to be sent cross-site, prefer sameSite: 'lax' or sameSite: 'strict'.