Tampermonkey / tampermonkey

Tampermonkey is the most popular userscript manager, with over 10 million users. It's available for Chrome, Microsoft Edge, Safari, Opera Next, and Firefox.
GNU General Public License v3.0
4.03k stars 413 forks source link

GM_cookie.set cannot set the sameSite value to None #2070

Closed zqff99 closed 14 hours ago

zqff99 commented 1 month ago

When the value of sameSite is set to Lax/Strict, it is successful. When it is set to None, the execution fails (execution should be allowed when secure is true).The browser is able to set sameSite to None using document.cookie.

Expected Behavior

Cookie set successfully.

Actual Behavior

The message port closed before a response was received. image

Specifications

Script

GM_cookie.set({ url: 'https://www.google.com/', name: 'test', value: 'value111', domain: '.google.com', path: '/', secure: true, httpOnly: true, sameSite: "None", expirationDate: Math.floor(Date.now() / 1000) + (60 60 24 * 30) }, function(error) { if (error) { console.error(error); } else { console.log('Cookie set successfully.'); } });

// ==UserScript==
// @name MyName
// @namespace http://mywebsite.com
// @Version 1.0
// @description try to take over the world!
// @author Me
// @match https://www.google.com/
// @require http://ajax.googleapis.com/ajax/libs/jquery/2.1.3/jquery.min.js
// @grant        GM_cookie
// @grant        unsafeWindow
// ==/UserScript==
(function() {
    'use strict';
unsafeWindow.GM_cookie = GM_cookie;//Debugging in the browser
  GM_cookie.set({
    url: 'https://www.google.com/',
    name: 'test',
    value: 'value111',
    domain: '.google.com',
    path: '/',
    secure: true,
    httpOnly: true,
    sameSite: "None",
    expirationDate: Math.floor(Date.now() / 1000) + (60 * 60 * 24 * 30)
  }, function(error) {
    if (error) {
      console.error(error);
    } else {
      console.log('Cookie set successfully.');
    }
  });
})
derjanb commented 1 month ago

Thanks for reporting. Please use sameSite: "no_restriction" -> https://developer.chrome.com/docs/extensions/reference/api/cookies#type-SameSiteStatus

Tampermonkey 5.2.6198 (crx) will now also report this issue via the error argument.

Just download the crx file linked above and drag and drop it to the extensions page chrome://extensions (after you've enabled 'Developer Mode').