RESOLVED INVALID 211180
1st party cookies blocked in iframe on 30x redirect with "Prevent cross-site tracking" 
https://bugs.webkit.org/show_bug.cgi?id=211180
Summary 1st party cookies blocked in iframe on 30x redirect with "Prevent cross-site ...
Lance H
Reported 2020-04-29 06:24:32 PDT
We are experiencing what seems to be a bug related to the new "Prevent cross-site tracking" feature in our application. The scenario is this: User is logged into our application, which uses cookies and traditional sessions for authorization. Our app opens an <iframe> to a 3rd party src (that happens to be a secure payment form for entering confidential payment information). The payment information is submitted to the third party form using no cookies at all. Once processing is finished, the third party's server responds with a 302 (or 303, we've tried both) redirecting the <iframe> back to the 1st party's domain. The <iframe> sends a request to the 1st party domain (matching the top level window's domain), but no cookies are sent along with the redirected request, so the request is seen as unauthorized, since the session cannot be found. We have no issues with any other browsers and did not have issues with Safari until the recent updates.
Attachments
Add attachment proposed patch, testcase, etc.
Radar WebKit Bug Importer
Comment 1 2020-04-29 18:01:03 PDT
<rdar://problem/62627006>
John Wilander
Comment 2 2020-04-29 18:34:59 PDT
Hi! Thanks for filing! We’re always interested in hearing from developers about our changes. What you’re reporting is not a bug. See “Cookie Blocking Latch Mode” in our latest blog post: https://webkit.org/blog/10218/full-third-party-cookie-blocking-and-more/
Brent Fulgham
Comment 3 2022-02-12 23:12:18 PST
This is behaving properly.
Note You need to log in before you can comment on or make changes to this bug.