Get Ready for the Google Chrome 80 Cookie Change

Google Chrome 80, scheduled to be released in February 2020, introduces a new default cookie attribute setting of SameSite=Lax. Previously, the SameSite cookie attribute defaulted to SameSite=None. Also new with Chrome 80, when SameSite is set to None, cookies must be tagged with the Secure attribute indicating that they require an encrypted HTTPS connection. Other browser vendors are expected to make similar changes soon. To get ready for the changes, enable the global security preference Enforce HTTPS. Also, test to see if client-side JavaScript code requires adjustments and to make sure that third-party integrations work as expected.

Why: Starting with the B2C Commerce 20.1 Preview Release, we implemented changes to ensure that cookies behave as expected after the Chrome 80 release. The B2C platform specifies SameSite=None for cookies from the server. You have to enable the global security preference Enforce HTTPS so that the server can mark cookies with the Secure attribute and specify SameSite=None. If Enforce HTTPS is not enabled, the server does not specify the SameSite attribute. In that case, the browser uses its own default SiteSame setting and doesn’t send cookies in cross-site contexts. Depending on the significance of the cookie, not sending it can break critical site functionality.

If you are using a B2C Commerce release previous to 20.1 Preview, you can enable the global security preference Enforce HTTPS to prepare for the changes.

We recommend that you test enabling Enforce HTTPS on a non-production instance before implementing the change on a production instance. We also recommend that you wait until after the holiday shopping season to make the change.

The functionality changes in response to the new Google Chrome SameSite default setting will be available in B2C Commerce as of January 9, 2020, for the 20.1 GA release, and as of January 16, 2020, for the 20.1 GA Update release.

If you set cookies using custom client-side JavaScript, test to determine if your code requires adjustments to accommodate the Chrome 80 changes. Also, test cross-site scenarios to make sure that third-party integrations work as expected with the Chrome 80 changes.

How: To enable Enforce HTTPS, in Business Manager, go to Administration | Global Preferences | Security. On the Access Restrictions tab, select Enforce HTTPS. Click Apply.

For more information about testing, refer to Get Ready for the Google Chrome Cookie Attribute Change.