2026-09-09 · 6 min read · Rahul Chitturi
- cookies
- authentication
- browser
A login callback can return successfully while the browser withholds the session cookie on a later request. SameSite decisions use the relationship between sites, request context, method, and browser policy; they are not simply a comparison of two complete origins.
Cookie transport and token validity are separate layers. Decoding a JWT cannot explain why its containing cookie was never sent.
Map every navigation boundary
Record the top-level page, request URL, redirect chain, scheme, registrable domain, port, method, embedded or top-level context, and cookie attributes. Use browser storage and network panels without copying cookie values.
- Check Domain, Path, SameSite, Secure, HttpOnly, and expiry
- Treat scheme changes as potentially cross-site
- Distinguish top-level navigation from fetch, iframe, and image requests
- Confirm proxy headers produce the intended secure callback URL
Select the narrowest valid policy
Prefer host-only Secure cookies and choose SameSite based on the documented flow. Cross-site embedded or request contexts that require SameSite=None also require Secure and need explicit cross-site request forgery defenses.
Do not loosen every session cookie to repair one integration. Separate transient login-correlation cookies from long-lived application sessions, constrain paths, rotate sessions after authentication, and validate OAuth state.
Test actual browser contexts
Use the URL tool to compare callback components, timestamp converter for expiry, diff for redacted attribute sets, and JWT tool only with synthetic tokens. Never paste a live session cookie into a debugging tool.
Test direct navigation, identity-provider redirects, POST callbacks, fetch requests, iframes, HTTP-to-HTTPS transitions, subdomains, local development, privacy modes, browser upgrades, expiry, logout, and session rotation.