Laravel app with login in iframe

Hello, I have the following problem. I want to embed my Laravel app (Site B) via an iframe on a website (Site A). The Laravel app in the iframe requires a login. I use middleware to check whether the referrer is correct, and if so, I log in a user using Auth::loginUsingId($user->id) and redirect to a landing page. This works in common desktop browsers, but not on mobile in Safari. It seems that not even a cookie from Site B is being set/accepted. My session configuration is: 'same_site' => 'none' 'secure' => true

If I disable "Prevent Cross-Site Tracking" in Safari on the client side, it works.

Console output: Blocked a frame with origin "SITE B" from accessing a frame with origin "SITE A". Protocols, domains, and ports must match.

What am I doing wrong?