Loading post…
OktaE. DunhamTutorial
How to Prepare Your Self
Summary
Okta warns that applications using its embedded Sign-In Widget may encounter Chrome login problems after January 1, 2025, when Google’s temporary exemption allowing third-party cookies ends. The guidance recommends testing with Chrome feature flags and watching for console errors, unexpected reauthentication, or logout during session extension. It presents four migration paths: issue first-party cookies through a custom domain, use the authorization code flow with refresh tokens, configure AuthJS with the offline_access scope, or replace deprecated sessions/me calls with supported OAuth and revocation mechanisms. A custom domain can require CSP updates for externally hosted sign-in resources, while offline_access must be enabled both on the authorization server and in application code. An Okta-provided script offers a temporary exemption through the end of 2024, but it is not a lasting fix.
Context
The guidance addresses Chrome’s third-party-cookie changes and their effect on applications using Okta’s embedded Sign-In Widget. It focuses on detecting session and login failures before the temporary exemption ends at the end of 2024.
Approach / What changed
Test the application with Chrome flags that disable or restrict third-party cookies, then migrate the affected flow using a custom domain for first-party cookies, the authorization code flow with refresh tokens, AuthJS offline access, or supported replacements for deprecated sessions/me endpoints. Re-test login, session extension, and session inspection behavior after implementation.
Takeaways
Chrome testing should check for developer-console errors, unexpected login prompts, and logout when a session is extended.
A custom Okta domain can make session cookies first-party, but externally hosted sign-in resources may require Content Security Policy updates.
AuthJS can use refresh tokens instead of cookies when offline_access is enabled in both the authorization server and the application configuration.
FAQ
How can an application test whether third-party-cookie changes affect its Okta login flow?
In Chrome, enable chrome://flags#third-party-cookie-deprecation-trial and chrome://flags/#tracking-protection-3pcd, and disable chrome://flags/#tpcd-metadata-grants. Sign in with the self-hosted widget, exercise cookie-dependent features, and check for console errors, repeated prompts, or logout during session extension.
What are the supported ways to remove the dependency on third-party cookies?
The guidance lists four options: configure a custom domain for first-party cookies, use the authorization code flow with refresh tokens, configure AuthJS for offline_access, or replace deprecated sessions/me calls with supported endpoints and refresh-token or revocation mechanisms.
Does Okta’s temporary third-party-cookie exemption provide a permanent solution?
No. An Okta-provided script can set a trial token that preserves third-party cookies for the login experience, but Google’s exemption ends at the end of 2024.
Source and freshness
- Source
- developer.okta.com
- Published
- Added to Yomu
Summaries are generated from the original by a language model. Check the original before relying on it.
Keep reading
Related reading
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
The best engineering reads, once a week
One useful email. Unsubscribe anytime.