Shopify’s server-set localization cookie on HTTPS storefronts is being flagged by audit tools because it lacks explicit Secure and SameSite attributes. The issue affects stores using Shopify Markets/localization and cannot be reliably fixed at the theme or merchant level because the cookie is created in Shopify’s Set-Cookie headers.
Participants note that missing SameSite is mostly an audit-label issue because modern browsers generally treat unspecified SameSite cookies as Lax by default. Missing Secure is considered the more substantive concern, though Shopify storefront HTTP requests are typically redirected to HTTPS.
The recommended action is to document the finding as Shopify-owned platform behavior, not theme debt. Merchants should verify the cookie in DevTools under the initial Network response, capture the exact Set-Cookie header and store URL, and submit it to Shopify Support or Partner Support for escalation.
The discussion remains unresolved: no fix is available from theme code, and the requested outcome is for Shopify to add Secure and SameSite=Lax at the platform level.
The localization cookie set by Shopify’s platform is missing the Secure and SameSite attributes on HTTPS stores. This is flagged by browser developer tools, PageSpeed Insights, and cookie audit tools.
Cookie name: localization
Missing:Secureattribute &SameSiteattributes
Flagged on: all HTTPS Shopify storefronts using Shopify Markets / localization
Expected behavior: All cookies set on HTTPS sites should include Secure and an explicit SameSite value (e.g. SameSite=Lax) as per modern browser security best practices and Google’s cookie requirements.
Request: Please update the localization cookie to include Secure and SameSite=Lax attributes at the platform level. This cannot be fixed at the merchant/ theme level as this cookie is set server-side by Shopify, and it creates noise in compliance and performance audits.
Worth splitting the two flags, because only one of them is actually doing anything to you.
SameSite is the quiet one. Chrome has treated a cookie with no SameSite attribute as Lax since version 80, and the other browsers landed in roughly the same place, so that cookie is already not travelling cross-site. What the audit is flagging is the missing attribute, not a behaviour difference. Secure is the one with real teeth, since without it the cookie will go out over a plain http request, although on a Shopify storefront you would first need something making an http request to the domain at all, and those get redirected.
One thing I would not try. You can overwrite a cookie from theme JS and add Secure yourself, but only if you match the name, domain and path exactly. localization is set server side, and if your rewrite lands on a slightly different scope you end up with two cookies of the same name, the browser sends both, and the country selector starts reading whichever one comes back first. That is an intermittent locale bug traded for an audit warning, which is a bad deal.
Out of curiosity, did the tool score it as a fail or as informational? Most cookie checkers put missing SameSite in the informational bucket, and that changes how it reads if you are handing the report to a client.
Yeah this one has to be fixed in Shopify’s Set-Cookie headers. You can’t safely patch Secure or SameSite from theme JS without risking a duplicte localization cookie and weird Markets switches, same as lumine said.
Best move for an audit is to screenshot the Network Set-Cookie line on first page load and file it with Shopify Support (Partner support if you have it) as a platform request. In teh report, mark localization as Shopify-owned so it doesn’t get treated like theme debt.
The audit noise is partly a classification problem. The localization cookie stores country/language selection, so in your consent or cookie-scanning tool it should sit under strictly necessary/functional, not marketing. That stops it counting as a tracking cookie, even though the missing Secure/SameSite attributes remain a real finding for Shopify to fix. Keep the platform finding separate from theme debt: verify in DevTools > Network that the Set-Cookie response header is served with the document response, before any theme JS runs, and note that no app or Liquid change can add those flags. When you send it to Shopify Support, include the exact header value and store URL so it can be routed to the platform team.