科技回声

5 条评论

Actual title (emphasis mine):> iOS 18 does not allow a client application to specify SameSite=NoneThat’s quite a different thing from the present submitted title, “No same site = None cookies for iOS18”, which would suggest SameSite=None was being blocked altogether.Glancing through, it reads more like “when SameSite default was changed from None to Lax [which everyone else did four years ago, if I recall correctly], there was a bug because the default was actually assumed in one other place that we missed, so that setting SameSite to None in a particular way didn’t work, and this pull request fixes that”. Simple bug, nothing to see here. But I’m not in Apple’s ecosystem, don’t trust my two-minute glance to be accurate and please correct me when I’m wrong.

评论 #41600377 未加载

评论 #41600209 未加载

srg08 个月前

From a user perspective, isn't it an improvement of privacy of iOS users?The bug report referenced in this issue is the case of invasive tracking (basically enterprise spyware) breaking in iOS18 <a href="https://bugs.webkit.org/show_bug.cgi?id=279153" rel="nofollow">https://bugs.webkit.org/show_bug.cgi?id=279153</a>Normal web usage is not affected.```- WebKit is honoring the cookie's SameSite=None attribute when the cookie is set by server in this case the IdP- Attempts to set this attribute from the client side (from the app interacting with the iOS cookie store) have been unsuccessful. For example, by setting `.sameSitePolicy = "none"`- Safari Web Inspector shows the option to set the cookie's SameSite attribute to None, it however, does not get honored either, and is immediately reverted.```

评论 #41599981 未加载

评论 #41599904 未加载

thih98 个月前

Does anyone have more context? Is this part of the general effort to not use third party cookies[1] or is this something more ios specific?[1]: <a href="https://developer.mozilla.org/en-US/blog/goodbye-third-party-cookies/" rel="nofollow">https://developer.mozilla.org/en-US/blog/goodbye-third-party...</a>

评论 #41600038 未加载

siva78 个月前

Oh boy i'm getting headaches again about SSO flows. How comes web development was easier back in 2005 than in 2024?

评论 #41600233 未加载

评论 #41600228 未加载

bitbasher8 个月前

My experience with SameSite equal None was to move it to Lax. Why? Because when a link in an email client is clicked and opens a site, the cookies are not sent.For example, you sign up to a website (A). You get a verify email sent to your inbox. You open your inbox (site B) and click the link. The link opens (A) but you're not logged in automatically upon verification, you get logged out because the cookie wasn't sent (since you're coming from B).It was quite disruptive to basic flows.