Safari solves this by sending third-party cookies only if the user visited the originating domain within 24 hours. Not sure how Firefox handles this but I gues

Safari solves this by sending third-party cookies only if the user visited the originating domain within 24 hours. Not sure how Firefox handles this but I guess it would be easy to detect a redirect from a1.com to p1.com and recognize this as a use-case where a third-party cookie from p1.com should be sent for a request originating from a1.com. That said it's probably more privacy-friendly to append an access token as a hash parameter to the URL when redirecting and extract it via JS, which will not be affected by cookie limitations.