Honor configured sameSite in transient cookies so you can login to iframe using 'none'

[adamjmcgrath]

Description

Honor the SameSite configuration (which defaults to 'lax') when setting the transient nonce/state cookies.

This will allow users to login to iframes over https when using the AUTH0_COOKIE_SAME_SITE config set to 'none'

References

Same as auth0/express-openid-connect#188
fixes #541

Testing

Tested by logging in to auth0 from an iframe in https://codepen.io/adamjmcgrath/pen/bGoKBMW

Checklist

• I have added documentation for new/changed functionality in this PR or in auth0.com/docs
• All active GitHub checks for tests, formatting, and security are passing
• The correct base branch is being used, if not main

[vercel]

This pull request is being automatically deployed with Vercel (learn more).
To see the status of your deployment, click below or on the icon next to each commit.

🔍 Inspect: https://vercel.com/auth0/nextjs-auth0/49Jo6WCjoszgAb3qZmm5ewwpWAd7
✅ Preview: Canceled

[richardscarrott]

I'm guessing this doesn't solve the issue for browsers which disable now 3rd party cookies, e.g. Chrome in incognito and Safari 🤔?

[adamjmcgrath]

@richardscarrott - for login to work with Safari's ITP (or Chrome Incognito) you'd need to use Custom Domains (In these cases the default Lax SameSite would suffice)

[richardscarrott]

@adamjmcgrath thanks for the reply, we're actually already using custom domains, however we want users to be able to login within our Shopify app, whereby our site is rendered in an iframe within the Shopify admin site so our domain is still considered 3rd party.

I don't suppose you know if Auth0 has any cookie-less solutions to login?

[adamjmcgrath]

Hi @richardscarrott

We don't recommend this flow except for highly trusted applications, but if your app is in a 3rd party iframe and you need to support Safari, you have little choice but the resource owner password grant (see https://auth0.com/docs/get-started/authentication-and-authorization-flow/resource-owner-password-flow)