How to disable SameSite cookie enforcement in Chrome

Decloak is an AI-powered web security intelligence platform that scans a site's HTTP/TLS posture, JavaScript, and third-party scripts to produce a report anyone can read. This guide is part of Decloak's library of practical, source-backed security guidance.

Key takeaways

• Chrome < 91: disable two flags in chrome://flags.
• Chrome 91 - 94: add --disable-features=SameSiteByDefaultCookies,CookiesWithoutSameSiteMustBeSecure to the launch command.
• Chrome ≥ 94: only enterprise policies (LegacySameSiteCookieBehaviorEnabled or LegacySameSiteCookieBehaviorEnabledForDomainList) can revert to legacy behavior.
• Verify your configuration with chrome://policy or chrome://flags.

Why does disabling SameSite matter?

Disabling SameSite lets legacy applications that set cookies without the SameSite attribute work without code changes, but it also removes a built - in CSRF mitigation. Use the steps below only for testing or controlled environments.

How do I disable SameSite in Chrome versions older than 91?

Open chrome://flags, search for "SameSite", set Same - site - by - default - cookies and Cookies - without - SameSite - must - be - secure to Disabled, then relaunch Chrome. This UI method fully disables the new SameSite checks for Chrome 80 - 90.

chrome://flags
# Search "SameSite"
# Set both flags to "Disabled"
# Relaunch Chrome

How can I turn off SameSite in Chrome 91 to 94?

Add a command - line switch to the Chrome shortcut or launch command. The switch disables the two features that enforce SameSite.

Windows shortcut target

"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-features=SameSiteByDefaultCookies,CookiesWithoutSameSiteMustBeSecure

Linux/macOS

google-chrome --disable-features=SameSiteByDefaultCookies,CookiesWithoutSameSiteMustBeSecure

The UI flags were removed in version 91, but the command - line switch works through version 94.

How do I revert to legacy SameSite behavior in Chrome 94 and newer?

Only enterprise policies can change the behavior. Deploy one of the following JSON policies via GPO, master preferences, or a JSON file on the machine.

Global legacy mode

{
 "LegacySameSiteCookieBehaviorEnabled": true
}

Per - domain legacy mode

{
 "LegacySameSiteCookieBehaviorEnabledForDomainList": ["example.com", "[*.]legacy.com"]
}

After deployment, open chrome://policy to confirm the policy shows OK. This reverts all cookies (or the listed domains) to the pre - May - 2019 handling where cookies without SameSite are treated as None.

How can I verify which method is active?

• For flag - based disabling, open chrome://flags and ensure the two SameSite flags are set to Disabled.
• For command - line disabling, open chrome://version and check the "Command Line" entry includes --disable-features=SameSiteByDefaultCookies,CookiesWithoutSameSiteMustBeSecure.
• For policy - based disabling, open chrome://policy and look for LegacySameSiteCookieBehaviorEnabled or LegacySameSiteCookieBehaviorEnabledForDomainList with status OK.

What are the security implications of turning off SameSite?

SameSite provides a default CSRF defense by restricting cross - site cookie transmission. Disabling it restores the older, less secure behavior and can expose your site to CSRF attacks. Google recommends fixing server - side cookie attributes (SameSite=None; Secure) instead of disabling the browser feature.

Quick cheat - sheet for all Chrome versions

References

1. StackOverflow - SameSite flags removed in Chromium 91 - shows flag method for older versions.
2. ExchangeTuts - Command - line syntax for Chrome 91 - 94.
3. Chromium policy documentation - LegacySameSiteCookieBehaviorEnabled policies.
4. Chrome testing guide - pre - 91 flag locations.
5. StackOverflow - disabling SameSite in Chrome 80.
6. ProgrammerAH - Shortcut example for disabling flags up to Chrome 94.
7. Google Chrome Community thread - discussion of post - 91 disabling options.