SameSite None Without Secure

A cookie is written through a web framework (Flask, Django, FastAPI/Starlette, Bottle, aiohttp, …​) with samesite='None' but without the secure flag enabled. The cross-site policy is set to None while secure is left False or omitted.

SameSite=None tells the browser to send the cookie on cross-site requests, re-enabling the exact behaviour that the SameSite mechanism exists to restrain. Modern browsers therefore only accept a SameSite=None cookie when it is also marked Secure; a cookie that is None without Secure is either rejected outright or, on older clients, transmitted over plain HTTP.

Omitting secure on a cross-site cookie exposes it to interception over insecure transport and re-opens the CSRF surface that SameSite was meant to close. Session and authentication cookies configured this way can be leaked or replayed.

When a cookie must be sent cross-site (samesite='None'), always mark it secure=True so it is only transmitted over HTTPS. If the cookie does not need to be sent cross-site, prefer samesite='Lax' or samesite='Strict'.