Safari Session Cookies Vanishing After Days: A Diagnostic Guide for ITP‑Related Expiration

Recognizable Condition

Users report being logged out of a web app after 2–5 days while the same session persists in Chrome or Firefox for weeks. The logout occurs on Safari 17+ (macOS 13+ or iOS 17+), but not on other browsers.

Underlying Cause

Safari’s Intelligent Tracking Prevention (ITP) imposes strict limits on script‑written cookies, third‑party cookies, and SameSite None without Secure. When a cookie falls into one of these categories, Safari caps its lifetime at roughly 7 days or blocks it entirely, causing session invalidation.

Diagnostic Table

Symptom	Likely Cause	Quick Check
Session ends after a few days	Script‑written cookie capped at 7 days	Inspect cookie Max‑Age and SameSite in Web Inspector
No cookie appears in Storage after 24 h	Third‑party cookie blocked	Check domain in Privacy Report
Cookie present but marked "Expired" immediately	SameSite=None without Secure on HTTP	Verify Secure flag in Set‑Cookie header
Cookie persists indefinitely in Chrome but not Safari	ITP classification of domain as tracker	Open Privacy Report → Tracker list

Ordered Checks

1. Confirm Safari & OS version
   • Safari > About Safari (e.g., 17.0.1)
   • System Settings > General > About (macOS 13.2, iOS 17.1)
   • Note that ITP thresholds shift with each Safari release.
2. Check Prevent Cross‑Site Tracking toggle
   • Safari > Settings > Privacy → "Prevent cross‑site tracking" (on/off)
   • When on, all third‑party cookies are blocked regardless of attributes.
3. Identify cookie origin
   • Open Web Inspector (⌘‑⌥‑I), go to Storage > Cookies, and locate the cookie.
   • Verify the domain and sub‑domain; if it differs from the top‑level site, it’s third‑party.
4. Inspect cookie attributes
   • In Web Inspector, check SameSite, Secure, Domain, Path, Max‑Age or Expires.
   • For server‑set cookies, view the Set‑Cookie header in Network tab.
5. Open Privacy Report
   • Click the shield icon in the address bar, select "Privacy Report".
   • Look for the cookie’s domain under "Blocked" or “Allowed”. If it’s flagged as a tracker, ITP may truncate its lifetime.
6. Reproduce with a minimal test
   • Create a test page that sets a cookie via document.cookie with Max‑Age=31536000 (1 yr) and SameSite=None.
   • Also set a server‑side cookie via Set‑Cookie: session=abc; SameSite=None; Secure; Max‑Age=31536000.
   • Open the page in Safari, wait 7 days, then check if the cookie still exists. Compare with Chrome/Firefox.

Fixes & Workarounds

• Use First‑Party Domain for Auth
  • Ensure the authentication cookie is set by the same domain that hosts the login page.
  • If a backend service is on a sub‑domain, redirect the user to that sub‑domain as the top‑level origin (e.g., https://auth.example.com).
• Set SameSite=None with Secure on HTTPS
  • Only use SameSite=None for cross‑site scenarios and always pair with Secure.
  • On HTTP, Safari treats SameSite=None as a security risk and may block it.
• Avoid CNAME‑cloaked tracker endpoints
  • Some analytics or advertising services use CNAME records to hide the true domain. Safari may classify these as trackers and cap cookies.
  • Move session handling to your own domain or use a dedicated sub‑domain not flagged as a tracker.
• Use Short‑Lived Tokens with Server‑Side Refresh
  • Instead of a long‑lived session cookie, issue a short‑lived JWT or opaque token (e.g., 15 min).
  • Implement a refresh endpoint that issues a new token before expiry.
  • Because the token is first‑party and server‑set, ITP will not cap it.
• Leverage the SameSite=Lax attribute for most session cookies
  • SameSite=Lax is accepted by Safari without restrictions and preserves the cookie across top‑level navigations.
  • Only use SameSite=None when you truly need cross‑site requests (e.g., iframes).

Escalation Path

1. If the cookie is still expiring after applying the above fixes, verify that the issue is not due to Private Browsing mode (which clears all cookies on exit).
2. Check the Apple Safari Web Extensions support for any known ITP bugs in the current release.
3. File a bug report with Apple, attaching the Safari version, OS, and a reproducible test case.
4. Consider adding a fallback authentication flow (e.g., re‑login prompt) for Safari users.

Practical Verification Checklist

• Open Safari, ensure "Prevent cross‑site tracking" is OFF for testing.
• Navigate to your login page; after login, open Web Inspector → Storage → Cookies, note the cookie attributes.
• Close Safari, reopen after 7 days, repeat the check.
• Verify the cookie still exists and has the same attributes.
• For a server‑set cookie, confirm the Set‑Cookie header in the Network tab matches the attributes you expect.
• Cross‑check the same steps in Chrome/Firefox to confirm Safari‑specific behavior.

Limitations & Version Sensitivity

• ITP thresholds and exemptions evolve with each Safari release. A fix that works on Safari 17.0 may not apply to Safari 18.0.
• Private Browsing mode always clears session cookies; the guide assumes normal browsing mode.
• Third‑party cookie blocking is absolute when "Prevent cross‑site tracking" is enabled.
• The guide focuses on session cookies; persistent storage (localStorage, IndexedDB) is handled differently by ITP.