Diagnosing Safari ITP‑Induced Login Loss and Cookie Clearing

Recognizable Condition

Users report being logged out of a website after a single page reload or navigation, even though they have not cleared cookies manually. The site relies on a third‑party domain (e.g., an identity provider or analytics service) to set authentication or session cookies.

Cause/Diagnostic Table

Observation	Likely ITP Cause
Cookie disappears from Storage tab within minutes/hours	ITP classified the third‑party domain as a tracker and capped its cookie lifetime (usually 24 h)
Console shows “Storage access denied” or “ITP: Third‑party cookie blocked”	Attempt to set/read a cookie in a third‑party context without user gesture
Network tab reveals missing Cookie header on requests to the third‑party domain after the first hit	ITP has purged the cookie, so the browser no longer sends it

Ordered Checks

1. Enable the Develop menu (if hidden)

   Run in Terminal: defaults write com.apple.Safari WebKitDeveloperExtras -bool true
   Requires admin rights; restart Safari. Risk: enables debugging features that may expose sensitive data if left on.

2. Inspect storage

   Open Safari → Develop → Show Web Inspector → Storage tab → Cookies. Look for the ITP icon (a shield) next to the cookie or note an unusually short Expires/Max‑Age.

3. Watch the console

   Develop → Show Console. Reload the page and trigger the login flow. Note any messages containing “Storage access denied”, “ITP”, or “Third‑party cookie blocked”.

4. Verify network cookie header

   In the Web Inspector Network tab, filter requests to the suspected third‑party domain. Check the Request Headers for a Cookie line. After the first request, the header should be absent or reduced if ITP has acted.

Fixes Tied to Findings

• If the cookie is being capped by ITP (no user gesture)
  • Move the authentication endpoint to a first‑party context (e.g., proxy the third‑party login through your own domain) so the cookie is set under your site’s origin.
  • Alternatively, after a user‑initiated action (click, tap), request storage access via the Storage Access API:

    if (document.requestStorageAccess) {
      document.requestStorageAccess().then(() => {
        // now you can set/read third‑party cookies
      }).catch(err => console.error(err));
    }

• If the site is incorrectly classified as a tracker

  Review the resources loaded from the third‑party domain. Remove unnecessary tracking scripts or serve them from a same‑origin endpoint. After changes, clear site‑specific data (Safari → Settings → Privacy → Manage Website Data) and retest.

• Temporary verification workaround

  Open the site in a Private Window; ITP restrictions are relaxed for the session, allowing you to confirm whether the issue is ITP‑related.

Escalation Criteria

• The problem persists after moving authentication to a first‑party context and using the Storage Access API correctly.
• Multiple unrelated sites report the same symptom, suggesting a broader ITP policy change.
• Console shows new ITP‑related errors not covered by the mitigation steps (e.g., “ITP: cookie blocked due to cross‑site tracking”).

In these cases, file a bug with Apple’s WebKit bug tracker, providing a minimal reproducer, the Web Inspector screenshots, and the exact Safari version.