ITP - All Third-Party Cookies Blocked on Websites Without Prior User Interaction

user_239558 0
Viewed 428

The latest ITP update on Preventing Tracking Prevention Tracking introduces this rule:

All Third-Party Cookies Blocked on Websites Without Prior User Interaction

ITP will now block all third-party requests from seeing their cookies, regardless of the classification status of the third-party domain, unless the first-party website has already received user interaction.

What does 'first-party' refer to in this rule?

Does this rule block cookies in requests that are issued before a user interacts with a document? What constitutes interaction and how is this detectable in Javascript?

Or does it refer to whether the third-party domain has been interacted with at some point in time, for example if the third-party domain is a login provider?

tracking safari
1 Answers

I'm going to answer this even though I added a bounty, I found the answer (to the 3rd party question at least)

Safari uses machine learning to determine whether a user "interacted" with a specific site or not. It is explained here.

Something like a redirect with window.location won't work, as the user did not physically visit the site.

If you run a single sign-on system with a centralized session, the user needs to interact with the domain that controls the session. Otherwise you run the risk of Intelligent Tracking Prevention treating your session controller domain as a tracker.

The only way around this (for SSO purposes) would be to have the user login through the domain that issues the cookie, and not as a CORS request.

Or physically disable ITP by unchecking the "Prevent cross-site tracking" checkbox:

enter image description here

user_4875240
Related