Channels
bot-training
community
contributing
general
github-activity
info
introductions
new-releases
random
security
support-questions
welcome-0xdelusion
welcome-aj-ya
welcome-aleksandrc
welcome-alpinjs
welcome-amberlamps1
welcome-andrew-rodriguez
welcome-ankit-choudhary
welcome-anthony-stod-custodio
welcome-call-in
welcome-chwalbox
welcome-claybiokiller
welcome-co7e
welcome-cosmoecwsa
welcome-devdag
welcome-dinso
welcome-drebotelho
welcome-elio
welcome-ernest
welcome-foxbarrington
welcome-fromscratch
welcome-galto4ir
welcome-goetzum
welcome-hay-kot
welcome-himanshu-kukreja
welcome-hossambarakat
welcome-ichikawakazuto
welcome-jahir9991
welcome-jamesl
welcome-jerry123424
welcome-john-oliver
welcome-jonas-alexanderson
welcome-jxyz
welcome-kelvinwop
welcome-kraz
welcome-lancekey
welcome-leoo
welcome-lukeacollins
welcome-m-j-mon
welcome-malik-khoja
welcome-marco
welcome-mardadi
welcome-meshguy
welcome-metamorph
welcome-mike-tectu
welcome-mirzok
welcome-mozomig
welcome-naberyou66_
welcome-nacer
welcome-namratha
welcome-naveenkumar
welcome-nightlight
welcome-nischith
welcome-notankit
welcome-olawumi
welcome-pavan-kumar-reddy-n
welcome-pineappaul
welcome-poothebear
welcome-rick
welcome-samuel-qosenergy
welcome-samuelstroschein
welcome-shubhamgoel23
welcome-shubhamkaushal
welcome-sidebar
welcome-surajsli
welcome-suyash_
welcome-syntaxerror
welcome-tauno
welcome-tawnoz
welcome-teclali
welcome-tls
welcome-turbosepp
welcome-vikram_shadow
Powered by
Hi cookie based auth is not working on
t
tom-glyphic
04/18/2023, 10:03 AM
Hi, cookie based auth is not working on desktop Safari, is that expected?
The signin request works, and we see the cookie being sent in subsequent requests, but they fail to authenticate
Sample debug log output:
https://cdn.discordapp.com/attachments/1097824596318765088/1097825110729162792/message.txt
It's the case that our api domain and website domain are different, is the solution to switch to header based auth?
https://github.com/supertokens/supertokens-core/issues/280
r
rp
04/18/2023, 10:08 AM
yup. You need to switch to using header based auth
since safari doesn't allow cross site cookies, even with sameSite as
none
t
tom-glyphic
04/18/2023, 10:09 AM
OK thanks, are there any downsides from using the header based auth? I see it's not the recommended method
r
rp
04/18/2023, 10:10 AM
it's less secure since the access and refresh tokens are exposed to frontend JS
but we do refresh token rotation, so it's such a big issue anyway
t
tom-glyphic
04/18/2023, 10:13 AM
OK thanks!
#support-questions
Join Discord