So basically with my app, I keep users access tokens in memory for the duration page load (e.g. once they refresh the token dissapears). To prevent them from having to sign in again, I have my auth server (https://api.myapp.com
) set a httpOnly, secure cookie with a refresh token. This works fine for most users, however, some users are able to set custom domains, this means that the client react app is now on theirapp.com
and trying to auth with my api on api.myapp.com
. This still works in Chrome (latest), Firefox, and Safari Incognito, but does not work in normal safari (seems to completely ignore the refresh cookie).
What possible solutions do I have to making this work? Basically I want it so that:
- user navigates to
theirapp.com
which makes a request toapi.myapp.com
- This returns a
set-cookie:
header with ahttpOnly; secure; domain; .myapp.com
refresh cookie.
I want it so that this cookie is then sent when the user refreshes and the SPA react app makes a POST request to api.myapp.com/auth/refresh
. Is this possible in safari (again this works in all other browsers and even safari incognito)?
I don't want to have to resort to storing a longer lived access token in the users localStorage or a non-httpOnly cookie as that's obviously pretty vulernable to XSS.
Community
script. I doubt the OP is still looking for an answer, but worth answering for other googlers!