[Webkit-unassigned] [Bug 211180] New: 1st party cookies blocked in iframe on 30x redirect with "Prevent cross-site tracking"

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=211180

            Bug ID: 211180
           Summary: 1st party cookies blocked in iframe on 30x redirect
                    with "Prevent cross-site tracking"
           Product: WebKit
           Version: Safari 13
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: Frames
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: lance at iclasspro.com

We are experiencing what seems to be a bug related to the new "Prevent cross-site tracking" feature in our application.  The scenario is this:

User is logged into our application, which uses cookies and traditional sessions for authorization.  Our app opens an <iframe> to a 3rd party src (that happens to be a secure payment form for entering confidential payment information).  The payment information is submitted to the third party form using no cookies at all.  Once processing is finished, the third party's server responds with a 302 (or 303, we've tried both) redirecting the <iframe> back to the 1st party's domain.  The <iframe> sends a request to the 1st party domain (matching the top level window's domain), but no cookies are sent along with the redirected request, so the request is seen as unauthorized, since the session cannot be found.

We have no issues with any other browsers and did not have issues with Safari until the recent updates.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20200429/9333c97d/attachment-0001.htm>