https://supertokens.com/ logo
Title
c

Chunkygoo

10/03/2022, 5:14 PM
cookies
@rp
lets say Im trying to access the cookies on myapp.vercel.app, but the cookies were issued by api.myapp.info
r

rp

10/03/2022, 5:16 PM
Right. You can’t
c

Chunkygoo

10/03/2022, 5:16 PM
The cookies have the attributes secure=true, samesite=none, domain=myapp.info
Can myapp.vercel.app use the cookies?
r

rp

10/03/2022, 5:17 PM
It can’t. Browser won’t allow that.
Cookies can only be shared if the domain is the same or the sub domain part is different.
If the entire domain is different, cookies won’t be shared
c

Chunkygoo

10/03/2022, 5:18 PM
Yeap but in the dm you said if samesite=none they can be shared?
r

rp

10/03/2022, 5:18 PM
Well, shared as in the cookies will get sent when the api call is made
But the other domain can’t read the cookies. Or if you query the other domain, the cookies won’t be sent to that one
c

Chunkygoo

10/03/2022, 5:19 PM
little confused
do you mind rephrasing "domain" and "other domain" with myapp.vercel.app and api.myapp.info?
r

rp

10/03/2022, 5:21 PM
Domain is myapp one
c

Chunkygoo

10/03/2022, 9:16 PM
@rp Do you think my understanding is accurate?
In short: samesite determines if the cookies are sent from the server to the browser, and domain determines if the cookies are sent from the browser to the server
r

rp

10/04/2022, 3:09 AM
No. SameSite determines if the cookies are sent from the browser to the server if the browser and server domain are of different origins
c

Chunkygoo

10/04/2022, 5:00 AM
I see I see. Thanks!