ReadMeFeed / Community knowledge
Real questions. Useful conversations. Find the people who know your stack.
SameSite default limits cross‑site POSTs in Chrome 80+ Chrome 80 and newer treat cookies without an explicit SameSite attribute as Lax . This default prevents the cookie from being sent on cross‑site POST requests, a behavior that often succeeds locally on localhost but fails on production HTTPS domains. The policy is documented in Chrome’s SameSite cookie s
Intelligent Tracking Prevention (ITP) Storage Caps Safari employs Intelligent Tracking Prevention (ITP) to limit the persistence of client-side storage. A documented behavior involves a 7-day cap on the expiration of cookies set via document.cookie , regardless of the specified Max-Age or Expires attributes. There is a distinction between cookies set via HTT
When upgrading from Flask 2.x to 3.x, the framework changes the default SAME_SITE attribute for session cookies from None to Lax . This adjustment improves CSRF protection but can unintentionally block legitimate cross‑site authentication flows that previously relied on SameSite=None . Because Flask ships with client‑side sessions by default, the entire sess
Integration boundary A web app embeds a cross-site authentication flow where a frontend on one origin sets SameSite=None; Secure cookies for an API on another. On localhost everything works: cookies are stored and sent as expected. Once deployed to production domains over HTTPS, Safari stops sending the cookies and the session appears lost. Constraints and u
ITP and Storage Access API Behavior The objective is to determine the precise persistence behavior of cookies within Safari's Intelligent Tracking Prevention (ITP) framework. ITP utilizes on-device machine learning to block trackers and caps first-party cookies set via JavaScript to a 7-day expiration for users who do not interact with the site. For third-pa
I'm validating a web integration that relies on first-party cookies and localStorage for session state, and I need to test it in Safari without using production credentials. The concern is Intelligent Tracking Prevention: client-side cookies set via document.cookie are documented as capped at 7 days, and storage can reportedly be deleted sooner for domains c
flask
safari