This Set-Cookie was blocked because it had the "SameSite=Lax" attribute but came from a cross-site response / SameSite=None requires Secure
The browser refused to store or send an auth/session cookie because of SameSite or Secure rules — so logins don’t “stick” across sites or iframes.
This Set-Cookie was blocked because it had the "SameSite=Lax" attribute but came from a cross-site responseSameSite=None requires Securecookie was rejected because it is in a cross-site contextThis attempt to set a cookie via a Set-Cookie header was blocked Meaning
Cross-site requests (frontend on app.com, API on api.otherdomain.com, embedded iframes, OAuth POST callbacks) need SameSite=None; Secure cookies over HTTPS. Browsers also increasingly block third-party cookies entirely.
Common causes
- API on a different site than the frontend with default SameSite=Lax
- SameSite=None without Secure (or on http)
- App embedded in an iframe on another site
- Third-party cookie blocking (Safari, Chrome)
⚡ Quick fix
- Serve frontend and API on the same site (subdomains of one domain)
- Use SameSite=None; Secure over HTTPS when cross-site is required
- Prefer token-based auth for cross-site APIs
Detailed fix by platform
JavaScript
res.cookie("sid", value, { httpOnly: true, secure: true, sameSite: "none", domain: ".example.com" });
How to diagnose
- Sites — Frontend vs API registrable domain
- Flags — SameSite/Secure in Set-Cookie
- DevTools — Cookie warnings in Network/Application
🔧 Still not fixed?
Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:
Similar errors
Most viewed in Authentication
Other ways to find it
Where this error sits
Origin: Application & API. Errors that are often confused with or caused by this one (click to open):
🧠 Still stuck? Analyze your error
Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.
💬 What worked for others
No tips yet — did something else fix this for you?
Share what worked for you
Tips are checked by an editor before they appear. Links are removed.
Report a correction or suggest an improvement
Last updated 12 Oct 2026