Safari doesn't set Cookie but IE / FF does

user_78048 0
Viewed 60081

I found a strange cookie problem on safari. If you surf to http://2much.ch you can enter with FF/IE and surf inside the site.

But if you use safari, you can enter only once; you can't surf inside the site. I found that Safari doesn't set the entered cookie, but FF/IE does.

What is wrong here?

safari cross-browser cookies
6 Answers

It looks like you hit a Safari bug here; you are redirecting any visiting browser to /entry while setting the cookie at the same time, and Safari is ignoring the Set-Cookie header when encountering the 302 HTTP status:

$ curl -so /dev/null -D - http://4much.schnickschnack.info/
HTTP/1.1 302 Moved Temporarily
Server: nginx/0.7.61
Date: Sun, 19 Jul 2009 12:20:49 GMT
Content-Type: text/html;charset=utf-8
Connection: keep-alive
Content-Length: 14260
Content-Language: de
Expires: Sat, 1 Jan 2000 00:00:00 GMT
Location: http://4much.schnickschnack.info/entry
Set-Cookie: colorstyle="bright"; Path=/; Expires=1248092449.12
Set-Cookie: _ZopeId="73230900A39w5NG7q4g"; Path=/

Technically, this would be a bug in Apple's Foundation Classes, I've found a WebKit bug that states this is the case.

I suppose the workaround is to set the cookie not in index_html but in entry instead.

In the intervening years since I first answered this question, this issue now appears solved, at least it was for Safari 6 when someone tested all major browsers for Set-Cookie support on 302 redirects in 2012.

user_1002970

After a great deal of pain, I found out that Safari (15.3) actually does save and my cookie, but it never displayed in developer tools storage -> cookies, but it works fine.

Here's the cookie I create and return in a Netlify function.

const secureCookie = cookie.serialize('jwtToken', JSON.stringify(jwtToken), {
      secure: process.env.CONTEXT !== 'dev',
      domain: process.env.CONTEXT === 'dev' ? 'localhost' : '.domain.com',
      httpOnly: true,
      sameSite: true,
      expires: new Date(Date.now() + (1000 * jwtToken.expires_in))
    })

and netlify function return

return {
      statusCode: 200,
      headers: {
        "Cache-Control": "no-cache",
      },
      multiValueHeaders: {
        "Set-Cookie": [secureCookie],
      },
      body: JSON.stringify(body),
    }
user_85124990
Related