As exaplained in https://web.dev/samesite-cookies-explained/, Chrome will enable SameSite=lax by default if SameSite is not specified.

In Apex, we can set Cookie using, Cookie ck = new Cookie('cookieLabel','cookieValue',null,-1,false);

How can i set SameSite=None;Secure for ck variable of Cookie class?

  • 1
    I have checked in Salesforce Spring'20 release. Now, all cookies will be SameSite=None and Secure by default. For more detail, visit help.salesforce.com/… Jan 16 '20 at 11:41

The new Spring '20 release, adds new System.Cookie constructor:

Cookie(name, value, path, maxAge, isSecure, SameSite)

Cross referencing my answer on [StackOverflow

As far as I can tell, the Apex Cookie Class does not support the SameSite attribute at all.

As a result, I would investigate using HttpResponse.setHeader() directly:

httpResponse.setHeader('Set-Cookie', 'cookieLabel=cookieValue; SameSite=None; Secure');

Be aware though, in other frameworks I do see the cookie handling overwrite any existing Set-Cookie headers so you may want to ensure you do any manual setting of headers either before or after the in-built cookie handling.

I would also raise a feature request for full support of the SameSite attribute in the framework.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.