mirror of
https://github.com/GitbookIO/gitbook.git
synced 2026-09-22 02:23:30 +00:00
a679eb21b1
The site preview runs in a cross-site iframe. The preview cookie that carries the unsaved customization (and theme) override was set with SameSite=Lax, so the browser withheld it on in-iframe navigations: the first page reflected the override (it comes from the ?customization= query param) but clicking to another page sent no param and no cookie, so the middleware fell back to the saved settings and the change disappeared. Send the preview cookie with SameSite=None + Secure in production, mirroring the visitor cookies that already have to survive this same iframe (getResponseCookiesForVisitorAuth). Dev stays same-origin so no attributes are needed there. SameSite=None requires Secure, so both are gated on production. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DwxstGi1QSoV6NQBdVDBye