2 ms·

I have third party cookies blocked, and have done so for at least a few years. The vast majority of sites, including SSO providers, function just fine. There sh

I have third party cookies blocked, and have done so for at least a few years. The vast majority of sites, including SSO providers, function just fine. There shouldn't be a need for third party cookies to enable auth flow when you can pass data back to the originating site in a number of other ways outside of the cookies.

svieira 2y ago
You can only pass data back to the originating site in one other way with GET and three other ways with any method that is expecting to have a body. But URL parameters are not a reasonable place to put sensitive information (even short-term authentication tokens) so that leaves us with body elements and headers. Headers can't be added programmatically in a redirect that needs to involve the client so you're left with POST-POST-POST and other fun. This doesn't _break_ the web, just makes it slower. That said, once you introduce embedding (A embeds B, both A and B want to delegate the user's identity through SSO-C) you find the real pain points of lacking ambient authentication on the web. But even this case is possible if the websites cooperate ... which unfortunately means that techniques that enable cooperating websites can be used for cross-site tracking as well.