The localization cookie set by Shopify’s platform is missing the Secure and SameSite attributes on HTTPS stores. This is flagged by browser developer tools, PageSpeed Insights, and cookie audit tools.
Cookie name: localization
Missing:Secureattribute &SameSiteattributes
Flagged on: all HTTPS Shopify storefronts using Shopify Markets / localization
Expected behavior: All cookies set on HTTPS sites should include Secure and an explicit SameSite value (e.g. SameSite=Lax) as per modern browser security best practices and Google’s cookie requirements.
Request: Please update the localization cookie to include Secure and SameSite=Lax attributes at the platform level. This cannot be fixed at the merchant/ theme level as this cookie is set server-side by Shopify, and it creates noise in compliance and performance audits.
Worth splitting the two flags, because only one of them is actually doing anything to you.
SameSite is the quiet one. Chrome has treated a cookie with no SameSite attribute as Lax since version 80, and the other browsers landed in roughly the same place, so that cookie is already not travelling cross-site. What the audit is flagging is the missing attribute, not a behaviour difference. Secure is the one with real teeth, since without it the cookie will go out over a plain http request, although on a Shopify storefront you would first need something making an http request to the domain at all, and those get redirected.
One thing I would not try. You can overwrite a cookie from theme JS and add Secure yourself, but only if you match the name, domain and path exactly. localization is set server side, and if your rewrite lands on a slightly different scope you end up with two cookies of the same name, the browser sends both, and the country selector starts reading whichever one comes back first. That is an intermittent locale bug traded for an audit warning, which is a bad deal.
Out of curiosity, did the tool score it as a fail or as informational? Most cookie checkers put missing SameSite in the informational bucket, and that changes how it reads if you are handing the report to a client.