It would appear that the new Safari cross-site tracking functionality is interfering with Google's OAuth2 implementation (at least in google sign-in for websites). I'm experiencing this issue with a project I'm currently developing, and would appreciate advice from anyone who has ran into the same problem.
Further details:
- With all cache/cookies cleared, the sign-in flow works properly on first login.
- Upon refreshing, entering the sign-in flow recognizes you are already authenticated with the OAuth provider, opens a popup and immediately closes it (this is expected behaviour for already allowed sources).
- after the popup closes, the finality of the auth flow is broken, and silently fails with no errors thrown inside the code, and no logged in user returned.
Unchecking the "prevent cross-site tracking" option allows the sign-in flow to behave as intended.