3 ms·
> The web will break. I have been using the First-Party Isolation feature for a few months now. FPI (privacy.firstparty.isolate) is a flag that was originally
by jannes 6y ago
> The web will break.
I have been using the First-Party Isolation feature for a few months now. FPI (privacy.firstparty.isolate) is a flag that was originally created for the Tor Browser project. It's a strict version of State Partitioning without any way to unpartition (no permission dialogs, no heuristics).
So far I have only come across one broken website: Microsoft Teams login through Okta SSO.
The rest of my logins worked flawlessly with FPI turned on. Nothing close to the 50% that you mention.
- undecisive 6y agoThat's encouraging news. Do you use a lot of sites with SSO? Are they mostly mainstream (where I would class MS Teams to fall in that bracket) or do they tend to be more niche services? (I totally accept that my "50% of SSO systems will be broken by this" to be a worst-case random number i-have-no-idea-but-for-all-I-know value. Probably shouldn't have been so blasé about it! But very much interested to hear what real-world values look like)
- not2b 6y agoOkta SSO is used heavily inside my company to access internal sites, but if there's a way to whitelist, or the user sees a popup the first time and allows Okta cookies after that, this problem is taken care of.
- egeozcan 6y agoI don't understand why the SSO would be broken. AFAICT, I'd just need to re-login to the SSO-provider (Okta in this case) in the context of the initiator (Microsoft Teams, in this case). They'd otherwise need to be doing something silly if it stops working.
- hirsin 6y agoTeams relies on iframe auth to fetch the Nth token from AAD (multiple resources to call, multiple tokens required). The iframe calls are partitioned and lose cookies, even under Firefox's helpful "redirect exemption" setup, it's not clear why.