Chrome M88 to Treat HTTP and HTTPS as Cross-Site Under Schemeful Same-Site Policy

Due to the Schemeful same-site policy applied from Chrome M88, HTTP and HTTPS sites on the same domain are treated as different sites (cross-site). This measure aims to resolve vulnerabilities to Cross-Site Request Forgery (CSRF) attacks and protect users.

Previously, they were considered same-site, allowing cookie transmission between HTTP and HTTPS even if the cookie's SameSite attribute was set to Strict or Lax. However, after the change, cookie transmission is blocked when set to Strict, and even when set to Lax, cookies are not sent for subresources or POST requests other than navigation.

Affected Areas and Countermeasures

This change may cause cookie transmission issues in the following three scenarios.

• Navigation: When moving between HTTP and HTTPS, SameSite=Lax cookies are sent, but Strict is blocked.
• Subresources and Form POST: SameSite=Lax cookies are also not sent for subresource requests such as iframes and images, or for Form POST method requests.
• WebSocket: HTTP sites can only send cookies to WebSocket, and HTTPS sites can only send cookies to WebSocket Secure.

The most recommended countermeasure is to upgrade to HTTPS. Since Chrome's long-term plan is to eliminate third-party cookies, changing cookie attributes is only a temporary measure. If switching to HTTPS is not possible, you can address navigation issues by setting SameSite=Lax, but subresource or WebSocket issues will not be resolved.

Testing can be performed by enabling the Schemeful Same-Site option in chrome://flags on Chrome 86 or later.