4 ms·
> Why is "cookies can't be used in 3rd-party context" not turned on from day 0? It's been the long-standing default of Safari to block 3rd-party cookies. As is
by matt4077 9y ago
> Why is "cookies can't be used in 3rd-party context" not turned on from day 0?
It's been the long-standing default of Safari to block 3rd-party cookies. As is described in the excellent post this links to, there is some functionality that 3rd-party cookies enable that can be beneficial. They use single-sign-on as an example.
- codedokode 9y agoSingle-sign on can be implemented without third-party cookies using only redirects. That is how OpenId and OAuth work. But social network widgets (Like buttons, comment form) would break without third-party cookies.
- floatboth 9y agoIf I understand correctly, "Single sign-on" means that when you sign in at one site, you're automatically signed in at others. Like when you sign in to Gmail, you get logged in on YouTube without any extra clicks. OAuth is typically a user-initiated action, like "Sign in with GitHub" or "Sign in with your domain" (https://indieweb.org/IndieAuthProtocol https://indieweb.org/IndieAuthProtocol). Though I think SSO should be possible with OAuth — maybe with a hidden iframe that does the auth process, or something with CORS requests… Or maybe a custom redirect-based protocol would be better.
- codedokode 9y agoOAuth can be modified so that it would not require any user action. When user visits a site, he gets redirected to the authorisation domain that checks whether the user is logged in and makes a redirect back to the original site, adding authorisation result to URL.