[CookieManager] Error: HttpException: SameSite value should be one of Lax, Strict or None.

[namnh-0652]

Package

cookie_manager

Version

3.2.0

Operating-System

iOS

Adapter

Default Dio

Output of flutter doctor -v

[!] Flutter (Channel stable, 3.32.7, on macOS 15.3.1 24D70 darwin-arm64, locale en-VN) [2.9s]
    • Flutter version 3.32.7 on channel stable at /Users/myname/Desktop/Development/SDKs/flutter
    ! Upstream repository unknown source is not a standard remote.
      Set environment variable "FLUTTER_GIT_URL" to unknown source to dismiss this error.
    • Framework revision d7b523b356 (9 days ago), 2025-07-15 17:03:46 -0700
    • Engine revision 39d6d6e699
    • Dart version 3.8.1
    • DevTools version 2.45.1
    • If those were intentional, you can disregard the above warnings; however it is recommended to use "git"
      directly to perform update checks and upgrades.

[✓] Android toolchain - develop for Android devices (Android SDK version 36.0.0) [7.8s]
    • Android SDK at /Users/myname/Library/Android/sdk
    • Platform android-36, build-tools 36.0.0
    • ANDROID_HOME = /Users/myname/Library/Android/sdk
    • ANDROID_SDK_ROOT = /Users/myname/Library/Android/sdk
    • Java binary at: /Users/myname/.CICD/JDK/jdk-17.jdk/Contents/Home/bin/java
      This JDK is specified in your Flutter configuration.
      To change the current JDK, run: `flutter config --jdk-dir="path/to/jdk"`.
    • Java version OpenJDK Runtime Environment (build 17.0.7+0-17.0.7b1000.6-10550314)
    • All Android licenses accepted.

[✓] Xcode - develop for iOS and macOS (Xcode 16.2) [7.9s]
    • Xcode at /Applications/Xcode.app/Contents/Developer
    • Build 16C5032a
    • CocoaPods version 1.16.2

[✓] Chrome - develop for the web [31ms]
    • Chrome at /Applications/Google Chrome.app/Contents/MacOS/Google Chrome

[✓] Android Studio (version 2025.1.2) [31ms]
    • Android Studio at /Applications/Android Studio Preview.app/Contents
    • Flutter plugin can be installed from:
      🔨 https://plugins.jetbrains.com/plugin/9212-flutter
    • Dart plugin can be installed from:
      🔨 https://plugins.jetbrains.com/plugin/6351-dart
    • Java version OpenJDK Runtime Environment (build 21.0.6+-13391695-b895.109)

[✓] Android Studio (version 2024.2) [30ms]
    • Android Studio at /Applications/Android Studio 3.app/Contents
    • Flutter plugin can be installed from:
      🔨 https://plugins.jetbrains.com/plugin/9212-flutter
    • Dart plugin can be installed from:
      🔨 https://plugins.jetbrains.com/plugin/6351-dart
    • Java version OpenJDK Runtime Environment (build 21.0.5+-12932927-b750.29)

[✓] IntelliJ IDEA Community Edition (version 2025.1.2) [29ms]
    • IntelliJ at /Applications/IntelliJ IDEA CE.app
    • Flutter plugin can be installed from:
      🔨 https://plugins.jetbrains.com/plugin/9212-flutter
    • Dart plugin can be installed from:
      🔨 https://plugins.jetbrains.com/plugin/6351-dart

[✓] VS Code (version 1.102.2) [11ms]
    • VS Code at /Applications/Visual Studio Code.app/Contents
    • Flutter extension version 3.114.0

[✓] Connected device (3 available) [12.6s]
    • iPhone 15 (mobile) • 9142A079-C987-4702-9215-9E21E12C28DC • ios            •
      com.apple.CoreSimulator.SimRuntime.iOS-17-4 (simulator)
    • macOS (desktop)    • macos                                • darwin-arm64   • macOS 15.3.1 24D70
      darwin-arm64
    • Chrome (web)       • chrome                               • web-javascript • Google Chrome
      138.0.7204.169

[✓] Network resources [502ms]
    • All expected network resources are available.

! Doctor found issues in 1 category.

Dart Version

3.8.1

Steps to Reproduce

Call an GET API request with this dio settings:

final storage = FileStorage('${MyPath/.cookies/');
final cookieJar = PersistCookieJar(storage: storage);
final cookieManager = CookieManager(cookieJar);
final dio = Dio(options)
    ..interceptors.addAll(
[cookieManager, 
// other interceptors
])

Expected Result

No error.

Actual Result

Got this error

e = HttpException (HttpException: SameSite value should be one of Lax, Strict or None.),
s = #0      _Cookie._parseSetCookieValue.parseAttributes (dart:_http/http_headers.dart:1074:15)
    #1      _Cookie._parseSetCookieValue (dart:_http/http_headers.dart:1091:5)
    #2      new _Cookie.fromSetCookieValue (dart:_http/http_headers.dart:1003:5)
    #3      new Cookie.fromSetCookieValue (dart:_http:883:20)
    #4      CookieManager._saveCookies.<anonymous closure> (package:dio_cookie_manager/src/cookie_mgr.dart:114:30)
    #5      MappedIterator.moveNext (dart:_internal/iterable.dart:420:20)
    #6      new _GrowableList._ofOther (dart:core-patch/growable_array.dart:207:26)
    #7      new _GrowableList.of (dart:core-patch/growable_array.dart:156:26)
    #8      new List.of (dart:core-patch/array_patch.dart:40:18)
    #9      Iterable.toList (dart:core/iterable.dart:517:7)
    #10     CookieManager._saveCookies (package:dio_cookie_manager/src/cookie_mgr.dart:115:10)
    #11     CookieManager.onResponse (package:dio_cookie_manager/src/cookie_mgr.dart:75:5)
    #12     DioMixin.fetch.responseInterceptorWrapper.<anonymous closure>.<anonymous closure> (package:dio/src/dio_mixin.dart:423:17)
    #13     new Future.<anonymous closure> (dart:async/future.dart:260:40)
    #14     Timer._createTimer.<anonymous closure> (dart:async-patch/timer_patch.dart:18:15)
    #15     _Timer._runTimers (dart:isolate-patch/timer_impl.dart:410:19)
    #16     _Timer._handleMessage (dart:isolate-patch/timer_impl.dart:441:5)
    #17     _RawReceivePort._handleMessage (dart:isolate-patch/isolate_patch.dart:193:12)

After making a big update, my API response got above error

Flutter version 3.7.11 -> 3.32.7
cookie_jar: 4.0.1 -> 4.0.8
dio: 5.1.1 -> 5.8.0+1
dio_cookie_manager: 3.0.0 -> 3.2.0

I degbuged and found that response still ok, and rejected by this interceptors.

// cookie_mgr.dart L73->L85
@override
void onResponse(Response response, ResponseInterceptorHandler handler) {
  _saveCookies(response).then((_) => handler.next(response)).catchError(
    (dynamic e, StackTrace s) {
      final error = DioException(
        requestOptions: response.requestOptions,
        error: e,
        stackTrace: s,
      );
      handler.reject(error, true);
    },
  );
}

Edited: It seems the samesite value is l (samesite=l;), so this cause the error. does this samesite set from Backend?

[AlexV525]

It doesn't seem to have anything wrong with the tip: https://www.google.com/search?q=SameSite+value+should+be+one+of+Lax%2C+Strict+or+None

[namnh-0652]

@AlexV525
Yes, it seems dio doesn't related to this error.
Flutter 3.7.11, which uses Dart 2.19.6, does not validate the SameSite attribute, so no error was thrown.
However, Flutter 3.32.7 with Dart 3.8.1 enforces SameSite validation, which results in an error being shown.

[AlexV525]

Thanks for digging into it. Should we close this issue? AFAICT you need to catch the exception and clear previous cookies maybe. The value typically comes from the server.

[namnh-0652]

you need to catch the exception and clear previous cookies maybe

@AlexV525 Because dio cookies already rejects the BE response with error as I said above

// cookie_mgr.dart L73->L85
@override
void onResponse(Response response, ResponseInterceptorHandler handler) {
  _saveCookies(response).then((_) => handler.next(response)).catchError(
    (dynamic e, StackTrace s) {
      final error = DioException( // <== here, reject response value, and return error
        requestOptions: response.requestOptions,
        error: e,
        stackTrace: s,
      );
      handler.reject(error, true);
    },
  );
}

We can catch it, but the response is now replaced with a DioException. So, we will continue investigating our backend code.
As for the Dio part, you might want to take it into consideration.

[AlexV525]

We can catch it, but the response is now replaced with a DioException. So, we will continue investigating our backend code. As for the Dio part, you might want to take it into consideration.

It is intended to return a DioException. I've filed #2428 to improve its behavior.

[namnh-0652]

Thanks much, now we can wait for next release and close this issue.