diff --git a/src/cdp/domains/fetch.zig b/src/cdp/domains/fetch.zig
index 0d4743de..88fce42d 100644
--- a/src/cdp/domains/fetch.zig
+++ b/src/cdp/domains/fetch.zig
@@ -244,21 +244,25 @@ fn continueRequest(cmd: anytype) !void {
         .new_url = params.url,
     });
 
+    const arena = transfer.arena.allocator();
     // Update the request with the new parameters
     if (params.url) |url| {
-        try transfer.updateURL(try page.arena.dupeZ(u8, url));
+        try transfer.updateURL(try arena.dupeZ(u8, url));
     }
     if (params.method) |method| {
         transfer.req.method = std.meta.stringToEnum(Http.Method, method) orelse return error.InvalidParams;
     }
 
     if (params.headers) |headers| {
+        // Not obvious, but cmd.arena is safe here, since the headers will get
+        // duped by libcurl. transfer.arena is more obvious/safe, but cmd.arena
+        // is more efficient (it's re-used)
         try transfer.replaceRequestHeaders(cmd.arena, headers);
     }
 
     if (params.postData) |b| {
         const decoder = std.base64.standard.Decoder;
-        const body = try bc.arena.alloc(u8, try decoder.calcSizeForSlice(b));
+        const body = try arena.alloc(u8, try decoder.calcSizeForSlice(b));
         try decoder.decode(body, b);
         transfer.req.body = body;
     }
@@ -304,7 +308,7 @@ fn fulfillRequest(cmd: anytype) !void {
     var body: ?[]const u8 = null;
     if (params.body) |b| {
         const decoder = std.base64.standard.Decoder;
-        const buf = try cmd.arena.alloc(u8, try decoder.calcSizeForSlice(b));
+        const buf = try transfer.arena.allocator().alloc(u8, try decoder.calcSizeForSlice(b));
         try decoder.decode(buf, b);
         body = buf;
     }
diff --git a/src/http/Client.zig b/src/http/Client.zig
index 2301df36..b2182222 100644
--- a/src/http/Client.zig
+++ b/src/http/Client.zig
@@ -620,13 +620,16 @@ pub const Transfer = struct {
     // redirectionCookies manages cookies during redirections handled by Curl.
     // It sets the cookies from the current response to the cookie jar.
     // It also immediately sets cookies for the following request.
-    fn redirectionCookies(arena: Allocator, easy: *c.CURL, cookie_jar: *CookieJar, origin: *const std.Uri) !void {
+    fn redirectionCookies(transfer: *Transfer, easy: *c.CURL) !void {
+        const req = &transfer.req;
+        const arena = transfer.arena.allocator();
+
         // retrieve cookies from the redirect's response.
         var i: usize = 0;
         while (true) {
             const ct = getResponseHeader(easy, "set-cookie", i);
             if (ct == null) break;
-            try cookie_jar.populateFromResponse(origin, ct.?.value);
+            try req.cookie_jar.populateFromResponse(&transfer.uri, ct.?.value);
             i += 1;
             if (i >= ct.?.amount) break;
         }
@@ -644,10 +647,11 @@ pub const Transfer = struct {
         const uri = try std.Uri.parse(url);
 
         var cookies: std.ArrayListUnmanaged(u8) = .{};
-        try cookie_jar.forRequest(&uri, cookies.writer(arena), .{
+        try req.cookie_jar.forRequest(&uri, cookies.writer(arena), .{
             .is_http = true,
-            .is_navigation = true,
-            .origin_uri = origin,
+            .origin_uri = &transfer.uri,
+            // used to enforce samesite cookie rules
+            .is_navigation = req.resource_type == .document,
         });
         try cookies.append(arena, 0); //null terminate
         try errorCheck(c.curl_easy_setopt(easy, c.CURLOPT_COOKIE, @as([*c]const u8, @ptrCast(cookies.items.ptr))));
@@ -670,12 +674,7 @@ pub const Transfer = struct {
         if (transfer.response_header == null) {
             if (transfer._redirecting and buf_len == 2) {
                 // parse and set cookies for the redirection.
-                redirectionCookies(
-                    transfer.arena.allocator(),
-                    easy,
-                    transfer.req.cookie_jar,
-                    &transfer.uri,
-                ) catch |err| {
+                redirectionCookies(transfer, easy) catch |err| {
                     log.debug(.http, "redirection cookies", .{ .err = err });
                     return 0;
                 };