Child Item

SameSite Cookies Error when trying to embed Embedder using dropins.js

I'm trying to utilize the new Embedder feature that was released in preview. Following the instructions on the page to-the-teeth and whitelisting localhost in the App Settings, I am getting a message regarding the Cookies that Dropbox provides about lacking the `SameSite` attribute. Apparently this is something that Dropbox itself needs to set since I'm requesting an iframe hosted by Dropbox (the embedder). Does anyone have any notes about bypassing this issue? Are there CORS settings that I'm neglecting to set up, I'm unsure because every tangentially related issue on Stack Overflow says the problem lies with the sourcec of the iframe. Below is the error message:

A cookie associated with a cross-site resource at https://dropbox.com/ was set without the `SameSite` attribute. A future release of Microsoft Edge will only deliver cookies with cross-site requests if they are set with `SameSite=None` and `Secure`. You can review cookies in developer tools under Application>Storage>Cookies and see more details at https://www.chromestatus.com/feature/5088147346030592 and https://www.chromestatus.com/feature/5633521622188032.

Thanks in advance, looking forward to clearing this up! :-)

Find more posts tagged with

API

Abuse

Comments

Greg-DB

Thanks for the report. Just to clarify, is this preventing the Embedder functionality from working for you? That message should just be a warning, not an error.

dangonzo

My bad, I should have made that clear, it works! I was just concerned about the warning.

Greg-DB

No problem, thanks for clarifying! There's nothing you need to do about that. I'll check with the team to see if there's something we can or should do about that though.

thesongcompany

Hi, is there a workaround to this yet? We get redirects from our Dropbox embeds in a PWA, and the platform team think it is related to this issue.

Thanks,

Antony

Greg-DB

@thesongcompany This thread was just referring to a warning message displayed in the console. That shouldn't have been related to any redirects. This is an old thread anyway though, so if something's not working as expected for you, please open a new thread with the details of the issues you're seeing, such as the relevant code and the steps to reproduce the issue, so we can look into it.