LegacySameSiteCookieBehaviorEnabledForDomainList

Revert to legacy SameSite behavior for cookies on specified sites.

If this policy is set to true, cookies set for domains in this list will revert to legacy SameSite behavior which means that cookies that don't explicitly specify a SameSite attribute are treated as if they were SameSite=None.

Values

LegacySameSiteCookieBehaviorEnabledForDomainList expects a list of domains, such as example.org. Cookies set for those domains revert to legacy SameSite behavior.

The policy sets the default behavior rather than locking it, so a user can still change it.

Examples

{
  "policies": {
    "LegacySameSiteCookieBehaviorEnabledForDomainList": [
      "example.org",
      "example.edu"
    ]
  }
}

JSON schema

{
  "type": "array",
  "items": {
    "type": "string"
  }
}

Windows (GPO)

Software\Policies\Mozilla\Firefox\LegacySameSiteCookieBehaviorEnabledForDomainList\1 = "example.org"
Software\Policies\Mozilla\Firefox\LegacySameSiteCookieBehaviorEnabledForDomainList\2 = "example.edu"

macOS

<dict>
  <key>LegacySameSiteCookieBehaviorEnabledForDomainList</key>
  <array>
    <string>example.org</string>
    <string>example.edu</string>
  </array>
</dict>

Compatibility

Firefox	Firefox ESR	Firefox Enterprise
Available since 76	Available since 78	Available since 149

CCK2 Equivalent: N/A
OMA-URI: LegacySameSiteCookieBehaviorEnabledForDomainList
Preferences Affected: network.cookie.sameSite.laxByDefault.disabledHosts