search

okta / okta-auth-js

The official js wrapper around Okta's auth API
Other
453 stars 265 forks source link

Apple preventing Cross-site tracking #371

Open patluri43 opened 4 years ago

patluri43 commented 4 years ago

Apple is preventing the cross-site tracking in version 13.1 and this is causing "session/me" and "getwithoutprompt" calls to fail.

aarongranick-okta commented 4 years ago

internal ref: OKTA-296984

ketankhade commented 4 years ago

Apple is preventing the cross-site tracking in version 13.1 and this is causing "session/me" and "getwithoutprompt" calls to fail.

Also, I'm facing same issue, because of preventing cross-site tracking "session/me" API is failing. If I enable preventing the cross-site tracking on safari it's working fine. Does anyone have an alternative solution?

Thanks,

Ketan

aarongranick-okta commented 4 years ago

@ketankhade We have updated our documentation on this issue: https://github.com/okta/okta-auth-js#third-party-cookies

You may be able to avoid this problem by using a custom domain: https://developer.okta.com/docs/guides/custom-url-domain/enable-the-custom-domain/ This may work because your app is now running on a "1st party" domain.

For "3rd party" domains, we are working on a longer term solution. In the short term our advice is to avoid using the API methods which are affected, or inform your users that 3rd party cookies are required.

NivethaMano commented 4 years ago

Do we have any other workaround here. We are using OKTA SIGN-IN widget to login which used cookies. We are facing similar problem.

swiftone commented 4 years ago

@NivethaMano - I'm working on upgrading the documentation in this sprint. A lot depends on what specifically you are doing that is breaking. What methods are you calling that fail? What are you trying to do with them? Then I can see if we have a workaround beyond a custom domain.

sjhanson commented 4 years ago

I'm also running into issues with the tokenManager.renew('accessToken') call. I think we can work around the rest of the limitations if we had a way to refresh our token. I tested on Safari v14.0 and it wouldn't work until I unchecked "Prevent cross-site tracking". Any ideas?

aarongranick-okta commented 4 years ago

@sjhanson We are currently working on a solution for renewing tokens that does not use cookies. This new solution is scheduled for release later this year. Unfortunately, the current implementation does require cookies and will fail if 3rd party cookies are blocked (such as "Prevent cross-site tracking" feature). Currently, token renew will fail on these browsers. Users must re-enter credentials in a new auth flow to obtain new tokens. Our current recommendation is to configure your token lifespan to a high time value (same or greater value of your session lifespan), then there will be no attempt to renew tokens until the session has also expired.

jamesking commented 3 years ago

@aarongranick-okta is there an update on a solution that doesn't break in Safari or Chrome Incognito? Thanks!

swiftone commented 3 years ago

@jamesking - Yes! We now have One Time Refresh Tokens available in Early Access. (https://developer.okta.com/docs/release-notes/#one-time-use-refresh-token-is-now-in-early-access-ea)

These allow you to request a refresh token and okta-auth-js will use it to renew your tokens rather than relying on the okta session (which means no third party cookie issues)

This guide is intended for one of our front end SDKs, but this section talks about the concept of the refresh token: https://developer.okta.com/docs/guides/sign-into-spa/react/before-you-begin/#refresh-tokens-and-spas

Meanwhile, this page of that same guide talks about how to turn on this early access feature and how to set up your app/client_id in the Okta console to be able to request the refresh token: https://developer.okta.com/docs/guides/sign-into-spa/react/create-okta-application/

Once you have the changes in the okta console, for you app you just need to use the latest okta-auth-js and include 'offline_access' in your requested scopes. The code will automatically use the refresh token to renew if one is available.

Hope that helps!

GreatEarl commented 3 years ago

Has this issue been fixed?

shuowu commented 3 years ago

@GreatEarl We are still working on "the longer term" solution. For now, you can follow the suggestion in https://github.com/okta/okta-auth-js/issues/371#issuecomment-643431027 to use the custom domain solution as a workaround.

GreatEarl commented 3 years ago

@shuowu Thanks for the advise but apparently, this issue does not exist in latest Safari v.14. At least, what didn't work for me in v.13 - signing up a new user, works fine now.