<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p
style="font-size:12.8px;text-decoration-style:initial;text-decoration-color:initial">Hi
all,</p>
<p
style="font-size:12.8px;text-decoration-style:initial;text-decoration-color:initial">We
have been having issues with renewing tokens via invisible iFrame
in our Javascript SDKs in the latest version of Safari - and
yesterday's news about ITP 2.0 seem to suggest that the new
default on Apple devices will be equivalent to disabling 3rd party
cookies, which AFAIK breaks OIDC session management... and/or
start displaying dialogs warning the user that they are being
tracked at every operation.<br>
</p>
<ul
style="font-size:12.8px;text-decoration-style:initial;text-decoration-color:initial">
<li style="margin-left:15px">Did anyone else experience similar
issues?</li>
<li style="margin-left:15px">What are the WG's thoughts about
whether this calls for a revision of how session works in OIDC?</li>
<li style="margin-left:15px">There is one RFC for WebKit that
could provide an alternative location for the session, detailed
<a href="https://github.com/whatwg/html/issues/3338">here</a>.
Did anyone consider it? Any insights?</li>
</ul>
<p
style="font-size:12.8px;text-decoration-style:initial;text-decoration-color:initial">If
the issue is confirmed, that will make use of OIDC session and
related token renewal machinery unfeasible on Macs, iPhones and
iPads. And without official guidance, that will likely spur a
cottage industry of custom solutions. I hope we can come up with
guidance that addresses the problem before that happens.</p>
<p
style="font-size:12.8px;text-decoration-style:initial;text-decoration-color:initial">Thanks
in advance for your insights</p>
V.
</body>
</html>