# Cookie not being set in Safari

> How to fix a cookie not being set in Safari during local development: Safari rejects the Secure attribute on localhost, so drop it and logins work again.

Author: [Flavio Copes](https://flaviocopes.com/about/) | Published: 2023-12-20 | Topics: [Web Platform](https://flaviocopes.com/tags/platform/) | Canonical: https://flaviocopes.com/cookie-not-being-set-in-safari/

I was surprised when a login workflow I implemented worked in all browsers except Safari.

Turns out Safari doesn’t allow setting the `secure` property on a cookie on localhost.

So I had to remove this cookie property, and things worked again.

From MDN:

*A cookie with the* *`Secure`* *attribute is only sent to the server with an encrypted request over the HTTPS protocol. It's never sent with unsecured HTTP (except on localhost), which means* [_man-in-the-middle_](https://developer.mozilla.org/en-US/docs/Glossary/MitM) *attackers can't access it easily. Insecure sites (with* *`http:`* *in the URL) can't set cookies with the* *`Secure`* *attribute.*

Also from MDN:

_Insecure sites (http:) cannot set cookies with the Secure attribute (since Chrome 52 and Firefox 52). The https: requirements are ignored when the Secure attribute is set by localhost (since Chrome 89 and Firefox 75)._

Not sure if this is how things should work and Chrome and Firefox allow this to make our life simpler, or it's a Safari bug, but that's how it is.