Since Chrome 85, a web page that's inside an iframe
and that's on a different domain than the parent won't be able to read its own cookies, unless they've explicitly been set using SameSite=None
and Secure
.
Won't work:
document.cookie = 'cookie-example=helloWorld';
Will work:
document.cookie = 'cookie-example=helloWorld; SameSite=None; Secure';
Note that other browsers may have different restrictions.