From b23ec4fa4553845138cbda823bb4e7bbd3d7242f Mon Sep 17 00:00:00 2001 From: john-redd Date: Wed, 26 Aug 2020 09:45:16 -0600 Subject: [PATCH] docs: note about samesite attribute and secure requirements closes #778 --- README.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/README.md b/README.md index bcccdbd8..77531505 100644 --- a/README.md +++ b/README.md @@ -110,6 +110,10 @@ More information about the different enforcement levels can be found in **Note** This is an attribute that has not yet been fully standardized, and may change in the future. This also means many clients may ignore this attribute until they understand it. +**Note** There is a [draft spec](https://tools.ietf.org/html/draft-west-cookie-incrementalism-01) +that requires that the `Secure` attribute be set to `true` when the `SameSite` attribute has been +set to `'none'`. Some web browsers or other clients may be adopting this specification. + ##### cookie.secure Specifies the `boolean` value for the `Secure` `Set-Cookie` attribute. When truthy,