[SalesForce] Cookie error with embedded VisualForce page in Chrome

I am pretty sure it works if you change the '.force.' to null in your Cookie creation. Just booted Windows, installed a gazillion updates, and then tested it in IE10.

That parameter is the path of the cookie, not the domain. Unfortunately the constructor of the Cookie class seems not to be documented, the best 'documentation' I found from Salesforce is in the example code of the documentation.

What's interesting is that Chrome and Firefox seem to ignore the path value '.force.' as it doesn't look like a proper path (maybe they only take it into account if it starts with a slash) while IE does not store the cookie as it doesn't match the path. Looking at RFC 6265 it seems that IE gets it wrong (Who would've thought ...):

If the uri-path is empty or if the first character of the uri-path is not a %x2F ("/") character, output %x2F ("/") and skip the remaining steps.

I let my application team know regarding this issue. I shared the console log error. They fixed it with adding cookies in the header in generic filter class that calls before to every request. That fixed for me. It goes like below.

class SameSiteFilter extends GenericFilterBean {
@Override
public void doFilter (ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
    HttpServletResponse resp = (HttpServletResponse) response;
    String cookie = resp.getHeader("Set-Cookie");
    if (cookie != null) {
        resp.setHeader("Set-Cookie", cookie + "; HttpOnly;SameSite=none; Secure");
    }
    chain.doFilter(request, response);
}}

This was done from application side. I didn't do anything from SF side. All other functionalities working fine.