I'm trying to implement something like the following and am not sure if what I'm doing falls under the concept of "3rd party cookies" (After all, I am aware that all 3rd party cookies will be blocked in the near future and I do not want to implement something that won't work soon).

Here's what I'm trying to do:

1. Log into https://siteA.com => siteA sets the cookie for its own domain (https://siteA.com) using sameSite=none
2. Go to https://siteB.com => siteB has a fetch() code that makes a cross origin request to https://siteA.com/resource.json, which is protected with siteA's cookie.

Basically, the user signs into siteA, and goes to siteB to load siteA's content. The authentication happens on siteA, not siteB.

siteB's code will contain the following JavaScript:

let response = await fetch("https://siteA.com/resource.json", {
  mode: "cors",
  credentials: "include"
}).then(r => r.json())

This way, siteB makes a fetch request to a resource on siteA. Normally this would fail because siteA only serves the JSON if a legit cookie from the domain https://siteA.com is set.

But assuming that user first goes to https://siteA.com and logs in, which sets the cookie on that domain, and only then goes to siteB, the siteB can make a cross origin request and load siteA content since now the browser has the siteA's cookie set.

What I'm confused about is whether this is considered a "3rd party cookie" and therefore won't work in the near future.

• If this is the case, does this mean all the authenticated cross origin requests we've been using won't work anymore?
• If this is NOT the case, what exactly IS a 3rd party cookie? and why is this scenario not a 3rd party cookie?
• Ultimately, can I use this approach? Or will this break in the future because of the 3rd party cookie stuff?

p.s.

Just for the record, this IS working today, on the latest version of chrome and safari. Which is why I am confused. I thought all of this would be blocked already.