I have an application that uses 3rd party cookie for multidomain authentication, setting the cookie parameters: domain, httponly, secure, samesite none and expires, to work with the context
- server domain: xyz.com
- client domain: abc.com and qwe.com
In this way, the same authentication cookie works for both client domains. However, browsers have a privacy-focused initiative to eliminate 3rd party cookies. Safari and Brave have already implemented it. Chrome will roll out in 2022.
This new policy is breaking the way I add cookies with multidomain.
I've already researched how to solve this, without stopping using cookies, but I couldn't find a way, other than using the header authorization with the token stored in the browser's Storage. In this case, it is not a 100% safe and attackable solution.
Does anyone have any direction on how I should handle authentication with multidomain without relying on storing the token in storage?