Chrome 80 in a cross-domain Iframe pass Cookie issue of Samesite

We know, by setting Access-Control-Allow-Credentials: trueand xhr.withCredentials = truecan achieve cross-domain transfer Cookie. Purpose of saving user login state and so on. However, improper use, there will be CSRF risk.
So, from the Chrome 51beginning, the browser Cookieadded a new SameSite property, to prevent CSRFattacks and user tracking.
The current setting is off by default, but Chrome 80after this feature is turned on by default.
So when you can not use some third-party Web site login feature, check to see if affected by this setting.

• For users, quick solution:

  1. Open the program Chromesettings, the chrome://flags/#same-site-by-default-cookiesDisabled, and then restart the browser.
  
  Scheme 2. Use low version of the browser, select the speed 360 .

• For developers, solution:

  1. The program SameSiteattribute values changed Nonewhile the secureproperty is set
  true. And the need to back-end service domain must use the httpsprotocol to access.
  2. Since the embodiment is provided SameSite = None, there is SCRFthe risk, therefore, the best solution is used tokeninstead of Cookiethe way for verification.