Thank you! I understand about flutter.

@rp I investigated the issue a little bit more. I think the issue is related to that our app is running in iframe. Everything seems to be fine outside iframe. Here are cookies I have

AFAIK for cookies to work in iframe they must be

Secure: true; SameSite: none

. The

sIRTFrontend

one doesn't meet this requirement and (my guess) is not used by browser.

Looking at /refresh request. I was right regarding the cookie policy. Notice the warning popup

I see. Those two cookies are set by the frontend, and consumed by the frontend itself.

Since they have no sameSite set, is it that they are not being set in the first place, and therefore the frontend (code that runs in the iframe) gets a null when reading them?

I can confirm that they are not being sent to the backend. Not sure if they can still be set/used by the frontend. Checking

> Not sure if they can still be set/used by the frontend They are only needed on the frontend. So that's all that matters really.

When I login inside iframe, only these cookies are set

I'd try adding SameSite=none to those cookies

got it. So if we set sameSite to be none, that will require the domain to be https right? How would one go about using https in localhost (when developing)?

and if we set it to lax, then it won't get set either way (since by default it's lax).

I think only

SameSite

is required if it's going to be used by frontend only

but doesn't samesite none require that the domain it's under is https?

and since the domain for these two cookies are the same as the website / iframe domain, those will need to be https?

i'll try to set it to none and see what happens.

I'm not sure... In our case website/iframe domains are different but they're both using https

yes that's in production. However in dev, they will be http correct?

I'm using ngrok for development, so it's https too

oooo! understood.

Will try and fix this today.

@User Can you please do the following and then try to use the iframe and see if it works: - Go to supertokens-website folder inside node_modules - In there, open lib > build > fetch.js - For each of the following lines, add

samesite=none

at the end of the string (before the closing "). For example, if a line is

ID_REFRESH_TOKEN_NAME + "=" + cookieVal + ";expires=" + expires + ";path=/";

, then change it to

ID_REFRESH_TOKEN_NAME + "=" + cookieVal + ";expires=" + expires + ";path=/;samesite=none";

Lines: - https://github.com/supertokens/supertokens-website/blob/master/lib/build/fetch.js#L1138 - https://github.com/supertokens/supertokens-website/blob/master/lib/build/fetch.js#L1141 - https://github.com/supertokens/supertokens-website/blob/master/lib/build/fetch.js#L1221 - https://github.com/supertokens/supertokens-website/blob/master/lib/build/fetch.js#L1224 - https://github.com/supertokens/supertokens-website/blob/master/lib/build/fetch.js#L1318 - https://github.com/supertokens/supertokens-website/blob/master/lib/build/fetch.js#L1321

Also, you may want to set

antiCsrf

value in the backend (Session.init) to

"VIA_TOKEN"

. Since you will be using an iframe.

Yes. I'll get back in a couple of hours with the result of this.

thanks!

@User instead of trying the above, please try the following: - Update your supertokens-auth-react dependency to

supertokens/supertokens-auth-react#0.13

- Delete yarn.lock file, and run

yarn install

. This should install new versions of

supertokens-auth-react

(0.13.0) and

supertokens-website

(7.1.0). - In the frontend config, change

SessionReact.init()

to

SessionReact.init({ isInIframe: true })

. - In backend config, change

SessionNode.init({ cookieSameSite: "none" })

to

SessionNode.init({ cookieSameSite: "none", antiCsrf: "VIA_TOKEN" })

- Try logging in via the iframe, and it should work.

I'm farting about with the supertokens context in react, and i'm finding the variables im getting from useSessionContext() aren't updating when i log in or log out. I am misunderstanding contexts or is this supposed to happen automatically?

@Healsies yea that’s an open issue at the moment. Have you wrapped your entire app with the auth wrapper? Or just individual routes that need auth to be accessed?

If you use them with individual routes that need auth to be accessed, it will work just fine (since logged in status in those routes won’t change).

this is the issue to watch for this feature: https://github.com/supertokens/supertokens-auth-react/issues/228