1519694 - The cookie is sent in other tab in spite of the “SameSite=Strict” setting.

Status: RESOLVED WORKSFORME

(Firefox :: Untriaged, defect)

Description

[Michael]

Attachment: StrictCookie.jpg

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/20100101 Firefox/64.0

Steps to reproduce:

I have used Private window in version 64.0 (64-bit) of FireFox Quantum.

I have logged in to my application and the cookie is set with the “SameSite=Strict” attribute.
See the attached StrictCookie.jpg.

Then, I have opened a REST API to my application in other tab of the browser.

Unfortunately, the call is successful.

My expectation that the cookies should not be sent and the request should be unauthenticated.

Actual results:

The cookie is sent in other tab in spite of the “SameSite=Strict” setting.

Expected results:

My expectation that the cookies should not be sent and the request should be unauthenticated.

Comment 1

[Michael]

Sorry,
How can I close the bug?
It works - need to open link from other page.