SameSite None Without Secure

A cookie is configured with SameSite=None but is not marked Secure. An http4k Cookie is created with sameSite = SameSite.None while secure is left false or omitted.

SameSite=None tells the browser to send the cookie on cross-site requests, re-enabling the exact behaviour that the SameSite mechanism exists to restrain. Modern browsers therefore only accept a SameSite=None cookie when it is also marked Secure; a cookie that is None without Secure is either rejected outright or, on older clients, transmitted over plain HTTP.

Omitting Secure on a cross-site cookie exposes it to interception over insecure transport and re-opens the CSRF surface that SameSite was meant to close. Session and authentication cookies configured this way can be leaked or replayed.

When a cookie must be sent cross-site (SameSite=None), always mark it Secure so it is only transmitted over HTTPS. If the cookie does not need to be sent cross-site, prefer SameSite=Lax or SameSite=Strict.