Heinzi's avatar

SameSite Cookies None problems with Safari browser 14.1

OS: Mojave Browser: Safari 14.1

I ve developed an API with a token-based authentication. The token gets put into a cookie and is than sent back and forth (until you are logged out). Here is the blog I used as blueprint: https://medium.com/@shindelav/make-an-api-based-application-with-laravel-passport-d6f1074a7b3a

Later I`ve adopted the session.php like this:

'secure' => env('SESSION_SECURE_COOKIE', true), 'same_site' => "none".

And the AuthController.php I configured the cookie like this:

return [ 'name' => '_token', 'value' => $token, 'minutes' => 1440, 'path' => null, 'domain' => null, // 'secure' => true, // for production 'secure' => true, // for localhost 'httponly' => true, 'samesite' => 'None', ];

All browsers work like a charme with SameSite=None and Secure=true but safari browser (14.1)

I came across this discussion: https://gist.github.com/koba04/d52765516600ec51d1761bb0ce994a11

I than turned off "Prevent cross-site tracking" in preferences->privacy and now Safari Browser works too, but this isn`t a sustainable solution. Does anybody have a feasible workaround ?

0 likes
0 replies

Please or to participate in this conversation.