safari-samesite-none.md

https://webkit.org/blog/10218/full-third-party-cookie-blocking-and-more/

1. Does Safari block 3rd party cookies with SameSite=None?

I've created to test it, but I'm confused by the result. https://animated-caribou.glitch.me/

The result

• Chrome: only display the cookie value with SameSite=None in iframe.
• Firefox: display all cookie values in iframe
• Safari(Catalina): display nothing in iframe
• Safari(Mojave): display all cookie values in iframe

	without SameSite attribute	SameSite=None
Safari 13.1(Catalina)	❌	❌
Safari 13.0(Catalina)	❌	❌
Safari 13.1(Mojave)	⭕️	⭕️
Chrome	❌	⭕️
Firefox	⭕️	⭕️

• ⭕️... Can get a 3rd party cookie
• ❌... Can not get a 3rd party cookie

It depends on the setting of "Prevent cross-site tracking" whether Safari blocks 3rd party cookies of which SameSite attribute is None or not.

The glitches

• The glitch of 1st party site.
  • https://glitch.com/edit/#!/animated-caribou (Code)
  • https://animated-caribou.glitch.me/ (Demo)
• The glitch of 3rd party site.
  • https://glitch.com/edit/#!/probable-oxidized-leather (Code)
  • https://probable-oxidized-leather.glitch.me/ (Demo)

Safari seems to block 3rd party cookies regardless of the SameSite attribute from Catalina.

If so, is this behavior only on Catalina(Safari 13.0, 13.1)?

I can't reproduce the behavior with Safari 13.1 on Mojave. But the blog post says "Safari 13.1 on macOS", which doesn't say anything about macOS versions.

Does Web Inspector support SameSite=None attribute?

When I run the glitch, Web Inspector doesn't mark the cookie as SameSite=None,

See the attached file in a comment. https://gist.github.com/koba04/d52765516600ec51d1761bb0ce994a11#gistcomment-3238700

You can reproduce this by visiting the site with Safari 13.1 on Catalina. https://probable-oxidized-leather.glitch.me/

@ceckoslab Thank you for your investigation!

If I am right then probably it's worthy that we open another issue/question for the Safari team.

Yeah, I agree with you.
According to your research, it seems to be a current behavior that Safari 13.1 on Catalina blocks all 3rd party cookies. The blog post didn't mention the OS version though.
https://webkit.org/blog/10218/full-third-party-cookie-blocking-and-more/

Hello @koba04

I filed a bug: https://bugs.webkit.org/show_bug.cgi?id=214608

But it looks like this is a feature ... concluded by reading some other people's bugs: https://bugs.webkit.org/show_bug.cgi?id=210298

Thank you!!

I was spinning my wheels trying to figure out what was going on with Safari and SameSite. This page saved me! Thank you very much!