title: SameSite cookie being blocked
body: <p><strong>Quick overview</strong>:
  I open my website at <em><strong>domain1</strong></em>. Inside a page, I load an iframe with url <em><strong>http://domain2/...</strong></em></p>
  <p>I keep on getting this warning on chrome and it has affected my website:</p>
  <blockquote>
  <p>A cookie associated with a cross-site resource at <em><strong>http://domain2</strong></em> was set without the <code>SameSite</code> attribute. It has been blocked, as Chrome now only delivers cookies with cross-site requests if they are set with <code>SameSite=None</code> and <code>Secure</code>. You can review cookies in developer tools under Application&gt;Storage&gt;Cookies and see more details at <a href="https://www.chromestatus.com/feature/5088147346030592" rel="nofollow noreferrer">https://www.chromestatus.com/feature/5088147346030592</a> and <a href="https://www.chromestatus.com/feature/5633521622188032" rel="nofollow noreferrer">https://www.chromestatus.com/feature/5633521622188032</a>.</p>
  </blockquote>
  <p>I never had to set cookies before so I'm unaware where the cookie should be set from. I've already tried setting <code>proxy_cookie_path</code> in my <em><strong>domain2</strong></em> nginx config but it doesn't seem to work:</p>
  <pre><code>location / {
      proxy_cookie_path / &quot;/; SameSite=None; Secure&quot;;
  }
  </code></pre>
  <p>I also tried adding <code>Set-Cookie</code> header which also doesn't seem to work:</p>
  <pre><code>location / {
      ...
      add_header 'Set-Cookie' 'SameSite=None; Secure';
  }
  </code></pre>
  <p>When I tried the second solution, it seems the the header was received from the response on chrome, but chrome gives the following warning:</p>
  <p><a href="https://i.stack.imgur.com/uxBRd.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/uxBRd.png" alt="enter image description here" /></a></p>
  <p>Note that <em><strong>domain2</strong></em> is our domain as well, and it has a python backend using Flask framework. So should I add the cookies from the python code or javascript frontend?</p>
  <p>This is getting really frustrating.</p>