Search code examples
expresssafaricsrfcsrf-tokenthird-party-cookies

CSRF Protection is not working in Safari browser due third party cookie blocking


I am working on a web application that use a frontend written with react and a backend server written with Nodejs express framework, the backend server is using csurf package in order to return to the client a csrf token as a cookie.

Anyway, recently when we move to an online pre production environment we noticed a problem on apple devices due to Safari third party cookie blocking, and unlike in Chrome for example there is no way to whitelist sites that are allowed to use third party cookie, it's either all of them or none. Does anybody have a good solution for potential apple users of the app?


Solution

  • The problem was solved a while ago. I think that what helped eventually was creating a gateway