search

fission-codes / auth-lobby

The authentication service that Fission services run.
https://auth.fission.codes
GNU Affero General Public License v3.0
12 stars 1 forks source link

Authentication breaks with browsers that implement State Partitioning #86

Open matheus23 opened 3 years ago

matheus23 commented 3 years ago

In the future, more browsers will implement State Partitioning. This will prevent unpermissioned cross-site communication to prevent tracking without consent. This will also break our authentication flow, which uses an iframe on the App's site to retrieve the UCAN and read key from authentication.

This already affects users of FIrefox Nightly and Brave today.

Keep in mind that error messages mentioning "cross origin cookies" are related, even though we're not using what's traditionally understood as cookies. LocalStorage, SessionStorage, IndexedDB and Cookies are all ways of creating state in websites and in some error messages are treated under the "cookie" banner.

I've started a draft on what a in-the-mean-time solution, which would ask the user for permission, would look like in #85

matheus23 commented 3 years ago

Related issue: https://github.com/fission-suite/auth-lobby/issues/88 with actual logs