Samesite cookie but allow specific domain

Question

I would like to secure my cookies using SameSite=strict. But is there a way to allow it to be accessed by few domains alone?

Answer 1

Whitelisting strict referral domains would be a fantastic enhancement to cookie mgmt, but AFAIK this doesn't exist.

I am evaluating my own solution to set cookies to LAX and then implementing my own whitelist that permits specific referrers, if the referring/redirecting website is not on the whitelist to then delete all cookies and force user to the login page. This would momentarily list/present existing cookies, which could be captured, but would be useless because the page(s) that were redirected to would immediately delete the cookies because the referrer wasn't whitelisted.

Answer 2

Take a look at the upcoming First Party Sets proposal from Google. This allows certain domains to be treated as if requests between them were same-site.

Note, however, that this is still in an early stage, is for now Google-specific and requires you to register the domains in a public repository.