Phoenix application setting same_site does not seem to have an effect

Did you find a solution?
My session cookie response header looks like this:

set-cookie: QkP2sE5XTAXz1ZTeFBkbHpZePsFRkg+Vw68lNMIOALmMHaGztVPu5DGMFh6UrXxF=SFMyNTY.g3QAAAACbQAAAAtfY3NyZl90b2tlbm0AAAAYTkJJU0Z0WmlBMFNsaUNHNVA3cTBCVjVqbQAAAAN1aWRkAANuaWw.UcnBA4UmEQwyMQQKyEK5XBdfMq6fjqhgzo4L-H_ZM4I; path=/; HttpOnly

My session_options are configures like this: same_site: "Strict".

i’m actually using

{:plug_cowboy, "~> 2.5"}

Hi,

it works on my side:

With the same in my Endpoint:

  @session_options [
    store: :cookie,
    # ...
    same_site: "Lax",
  ]

  # ...

  plug Plug.Session, @session_options

Which version of Plug are you using? You need Plug >= 1.10.1 (you can, for example, check the output of mix deps).

v1.10.1 (2020-05-15)

• [Plug.Conn] Support :same_site option when writing cookies

(which is already quite old)