koba04/safari-samesite-none.md

Last active July 26, 2022 10:37

Star 13 You must be signed in to star a gist
Fork 0 You must be signed in to fork a gist

Learn more about clone URLs
Clone this repository at <script src="https://gist.github.com/koba04/d52765516600ec51d1761bb0ce994a11.js"></script>
Save koba04/d52765516600ec51d1761bb0ce994a11 to your computer and use it in GitHub Desktop.

Download ZIP

Raw

safari-samesite-none.md

https://webkit.org/blog/10218/full-third-party-cookie-blocking-and-more/

1. Does Safari block 3rd party cookies with SameSite=None?

I've created to test it, but I'm confused by the result. https://animated-caribou.glitch.me/

The result

Chrome: only display the cookie value with SameSite=None in iframe.
Firefox: display all cookie values in iframe
Safari(Catalina): display nothing in iframe
Safari(Mojave): display all cookie values in iframe

	without SameSite attribute	SameSite=None
Safari 13.1(Catalina)	❌	❌
Safari 13.0(Catalina)	❌	❌
Safari 13.1(Mojave)	⭕️	⭕️
Chrome	❌	⭕️
Firefox	⭕️	⭕️

⭕️... Can get a 3rd party cookie
❌... Can not get a 3rd party cookie

It depends on the setting of "Prevent cross-site tracking" whether Safari blocks 3rd party cookies of which SameSite attribute is None or not.

The glitches

The glitch of 1st party site.
- https://glitch.com/edit/#!/animated-caribou (Code)
- https://animated-caribou.glitch.me/ (Demo)
The glitch of 3rd party site.
- https://glitch.com/edit/#!/probable-oxidized-leather (Code)
- https://probable-oxidized-leather.glitch.me/ (Demo)

Safari seems to block 3rd party cookies regardless of the SameSite attribute from Catalina.

If so, is this behavior only on Catalina(Safari 13.0, 13.1)?

I can't reproduce the behavior with Safari 13.1 on Mojave. But the blog post says "Safari 13.1 on macOS", which doesn't say anything about macOS versions.

Does Web Inspector support SameSite=None attribute?

When I run the glitch, Web Inspector doesn't mark the cookie as SameSite=None,

See the attached file in a comment. https://gist.github.com/koba04/d52765516600ec51d1761bb0ce994a11#gistcomment-3238700

You can reproduce this by visiting the site with Safari 13.1 on Catalina. https://probable-oxidized-leather.glitch.me/

Author

Summary

It depends on the setting of Prevent cross-site tracking whether Safari blocks 3rd party cookies even if SameSite is None.

Author

How to Display `SamSite=None` is different from each browser

Chrome

Firefox

Safari

grundmanise commented May 15, 2020

Thank you for the investigation 👍 Chrome is anticipated to introduce the same in 2022. Now we're forced to stop using 3d party cookies even for legit use-cases.

Author

koba04 commented May 15, 2020

@grundmanise Yes, Chrome has postponed changing the default SameSite attribute Lax so the timeline might be changed.

ceckoslab commented Jul 21, 2020

Hello @koba04

That's pretty interesting finding. I am not sure if this is a bug but did you have a chance to talk with the Safari team?

Author

koba04 commented Jul 21, 2020

@ceckoslab I've filed the issue and had an answer from the WebKit team.

The em dash (—) represents the "None" value, both in the case that it is explicitly specified (SameSite=None) and in the case that SameSite is entirely omitted (from what I understand, this will be interpreted as if SameSite=None).

https://bugs.webkit.org/show_bug.cgi?id=210178

ceckoslab commented Jul 21, 2020

Hello @koba04,

Thanks for responding so quickly. My question was more about the point "1. Does Safari block 3rd party cookies with SameSite=None?". The different behavior between Catalina and Mojave is the thing that worries me and looks like it could break things.

Are you aware of any bug reports about point 1?

ceckoslab commented Jul 21, 2020

Hello @koba04,

I think that I finally understood it. Seems that we have different behavior in Mojave and Catalina when Prevent cross-site tracking is enabled.

My confusion with this is that I can' find any release notes that say if that is the intended behavior. My theory is that in Catalina the Safari team fixed what was their initial intend with Prevent cross-site tracking in Mojave but probably they were not so strict in Mojave ...

Thanks for doing the research!

Author

koba04 commented Jul 21, 2020

@ceckoslab As I mentioned https://gist.github.com/koba04/d52765516600ec51d1761bb0ce994a11#gistcomment-3305451, I've found that this depends on the setting of "Prevent cross-site tracking".
But I could not confirm that how Safari on Mojave behaves because I don't have any environments of Mojave.

Do you mean that there is a case that Mojave doesn't block 3rd party cookie?

ceckoslab commented Jul 21, 2020 •

edited

Yes @koba04 , on Mojave I can see on SiteB the following cookies: foo=SiteBCookie; foo2=SiteBNone.

If I am right then probably it's worthy that we open another issue/question for the Safari team.

Reference:

OS version: macOS Mojave 10.14.6
Browser: Safari Version 13.1.1 (14609.2.9.1.3)

Prevent cross-site tracking: Enabled

Result from your test:

Author

koba04 commented Jul 21, 2020

@ceckoslab Thank you for your investigation!

If I am right then probably it's worthy that we open another issue/question for the Safari team.

Yeah, I agree with you.
According to your research, it seems to be a current behavior that Safari 13.1 on Catalina blocks all 3rd party cookies. The blog post didn't mention the OS version though.
https://webkit.org/blog/10218/full-third-party-cookie-blocking-and-more/

ceckoslab commented Jul 21, 2020

Hello @koba04

I filed a bug: https://bugs.webkit.org/show_bug.cgi?id=214608

But it looks like this is a feature ... concluded by reading some other people's bugs: https://bugs.webkit.org/show_bug.cgi?id=210298

Author

koba04 commented Jul 22, 2020

Thank you!!

kylekyle commented Aug 8, 2020

I was spinning my wheels trying to figure out what was going on with Safari and SameSite. This page saved me! Thank you very much!

koba04/safari-samesite-none.md

1. Does Safari block 3rd party cookies with SameSite=None?

The result

The glitches

If so, is this behavior only on Catalina(Safari 13.0, 13.1)?

Does Web Inspector support SameSite=None attribute?

koba04 commented Apr 3, 2020

koba04 commented Apr 15, 2020

koba04 commented Apr 15, 2020

grundmanise commented May 15, 2020

koba04 commented May 15, 2020

ceckoslab commented Jul 21, 2020

koba04 commented Jul 21, 2020

ceckoslab commented Jul 21, 2020

ceckoslab commented Jul 21, 2020

koba04 commented Jul 21, 2020

ceckoslab commented Jul 21, 2020 •

edited

koba04 commented Jul 21, 2020

ceckoslab commented Jul 21, 2020

koba04 commented Jul 22, 2020

kylekyle commented Aug 8, 2020

koba04/safari-samesite-none.md

1. Does Safari block 3rd party cookies with SameSite=None?

The result

The glitches

If so, is this behavior only on Catalina(Safari 13.0, 13.1)?

Does Web Inspector support SameSite=None attribute?

koba04 commented Apr 3, 2020

koba04 commented Apr 15, 2020

Summary

koba04 commented Apr 15, 2020

How to Display SamSite=None is different from each browser

Chrome

Firefox

Safari

grundmanise commented May 15, 2020

koba04 commented May 15, 2020

ceckoslab commented Jul 21, 2020

koba04 commented Jul 21, 2020

ceckoslab commented Jul 21, 2020

ceckoslab commented Jul 21, 2020

koba04 commented Jul 21, 2020

ceckoslab commented Jul 21, 2020 • edited

koba04 commented Jul 21, 2020

ceckoslab commented Jul 21, 2020

koba04 commented Jul 22, 2020

kylekyle commented Aug 8, 2020

How to Display `SamSite=None` is different from each browser

ceckoslab commented Jul 21, 2020 •

edited