Cookie SameSite Debugging Guide

Secure, HttpOnly, SameSite, CORS credentials, browser DevTools and session failures. Last updated August 31, 2026.

MDN documents Set-Cookie attributes including Secure, HttpOnly, Path, Domain and SameSite. SameSite=None requires Secure, and HttpOnly prevents JavaScript access to the cookie while still allowing the browser to send it with HTTP requests. See MDN Set-Cookie and MDN Using HTTP cookies.

Common session failure pattern

Symptom	Likely cause	Next check
Login succeeds but next API call is anonymous	Cookie not stored or not sent	Check `Set-Cookie`, browser Application tab and request `Cookie` header.
Works on localhost, fails on domain	HTTPS, domain, path or SameSite mismatch	Compare localhost exception with production HTTPS behavior.
Cross-site frontend cannot stay logged in	Missing `SameSite=None; Secure` or missing CORS credentials	Check frontend credentials mode and CORS response headers.
JavaScript cannot read session cookie	`HttpOnly` is set	This is usually correct for session cookies.

Inspect cookie headers

curl -i https://app.example.com/login
curl -I https://app.example.com/
curl -i https://api.example.com/me \
  -H "Origin: https://app.example.com" \
  -H "Cookie: session=REDACTED"

Attribute checklist

Secure: required for HTTPS-only cookies and required with SameSite=None.
HttpOnly: recommended for session identifiers that JavaScript should not read.
SameSite=Lax: practical default for many first-party sessions.
SameSite=Strict: stronger, but can break expected cross-site navigation flows.
SameSite=None: needed for many cross-site embedded or API credential flows, but must be paired with Secure.
Domain: omit unless subdomains need the cookie; wide domains increase risk.

Cross-site API checklist

frontend fetch credentials:
api Access-Control-Allow-Credentials:
api Access-Control-Allow-Origin:
cookie SameSite:
cookie Secure:
cookie Domain:
cookie Path:
request Cookie header present:
browser blocked reason:

Safer cookie starter

Set-Cookie: __Host-session=REDACTED; Path=/; Secure; HttpOnly; SameSite=Lax

The __Host- prefix is useful when the cookie should be bound to the exact host, have Path=/, use Secure and avoid a broad Domain attribute.

Cookie debugging requires both sides of the story: the response that sets the cookie and the later request that should send it. Looking at only one side creates false answers.