SameSite cookie in Safari web extension

Question

areknawo OP

Created Sep ’22

Replies 2

Boosts 2

Views 1.7k

Participants 3

I'm porting a Chrome extension to Safari. All works well besides the auth flow, which uses SameSite=Strict cookies.

On Chrome, such cookies are easily set and work as expected, but not on Safari.

Now, as I understand, technically, requests from chrome-extension:// and safari-web-extension:// origins are cross-site in relation to the server, which makes me think that on Chrome, the SameSite=Strict attribute is simply ignored as an exception for extensions. With that said, the backend team wants to keep the attribute for security reasons and so removing it or replacing it with SameSite=None isn't an option.

Is this an intended behavior of Safari or a bug? Is there a way to get around this without changing the attribute?

Boost

Answer 1

mdz-polymorph OP

Jul ’23

Having the same issue debugging a safari web extension converted using the xcrun command from an existing chrome web extension written in JavaScript. Are there any plans to look at this Safari behavior?

1

Answer 2

mr-fixit-nyt OP

Feb ’24

I have a similar issue, but in my case, the server's Set-Cookie has SameSite=None

0