Safari not including cookies in request, but Safari incognito does?

user_6458966 0
Viewed 1391

So with my app I allow our users to set their own custom domiain which points to our hosted app on netlify. This works fine, but now the frontend is obviously talking to an api which lives on a different domain.

On the auth cookie I send back from the api, I have SameSite=None which works on all other browsers except for safari where the request does not include the cookie. However, if I go on Safari in incognito, it does include the cookie on the request? My question is:

  1. Why does this work in safari incognito and not normal?
  2. Is there a way to make this work in normal safari?

Here is a more thorough example:

front end: 
customersdomain.com

api:
api.myapp.com

Cookie

x-refresh: <cookie_val>
SameSite: none
HttpOnly: true
Secure: true
expires: 1 month
domain: api.myapp.com

My cors has allow credentials set as well and in the request I have credentials set to include.

safari cookies
1 Answers

In Safari 13.1, in order for third party requests to have access to credentials/cookies, you must use the Storage Access API to request access, via an iframe.

This may affect the workings of your app considerably. Please read WebKit's recent blog post for more information about the latest changes to their Intelligent Tracking Prevention.

Before Safari 13.1, there were some temporary compatibility fixes as detailed here to allow for third party requests to have access to cookies. My guess is that the third party domain was flagged by Safari on your device as being a domain that has the potential to track users, and blocked from having access to cookies by default. The domain will remain blocked for as long as you don't clear the cache on Safari. By using an incognito window, the domain was no longer blocked for that session.

SameSite=None compatibility was added to Safari 13, so this shouldn't have contributed to any of your issues.

user_35011040
Related