---
title: "How to Prepare Your Self"
description: "Okta warns that applications using its embedded Sign-In Widget may encounter Chrome login problems after January 1, 2025, when Google’s temporary exemption allowing third-party cookies ends. The guidance recommends testing with Chrome feature flags and watching for console errors, unexpected reauthentication, or logout during session extension. It presents four migration paths: issue first-party cookies through a custom domain, use the authorization code flow with refresh tokens, configure AuthJS with the offline_access scope, or replace deprecated sessions/me calls with supported OAuth and revocation mechanisms. A custom domain can require CSP updates for externally hosted sign-in resources, while offline_access must be enabled both on the authorization server and in application code. An Okta-provided script offers a temporary exemption through the end of 2024, but it is not a lasting fix."
---

# How to Prepare Your Self

[Okta](https://yomu.fyi/company/okta) · E. Dunham · Apr 8, 2024

**Type:** Tutorial

## Summary

Okta warns that applications using its embedded Sign-In Widget may encounter Chrome login problems after January 1, 2025, when Google’s temporary exemption allowing third-party cookies ends. The guidance recommends testing with Chrome feature flags and watching for console errors, unexpected reauthentication, or logout during session extension. It presents four migration paths: issue first-party cookies through a custom domain, use the authorization code flow with refresh tokens, configure AuthJS with the offline\_access scope, or replace deprecated sessions/me calls with supported OAuth and revocation mechanisms. A custom domain can require CSP updates for externally hosted sign-in resources, while offline\_access must be enabled both on the authorization server and in application code. An Okta-provided script offers a temporary exemption through the end of 2024, but it is not a lasting fix.

## Context

The guidance addresses Chrome’s third-party-cookie changes and their effect on applications using Okta’s embedded Sign-In Widget. It focuses on detecting session and login failures before the temporary exemption ends at the end of 2024.

## Approach / What changed

Test the application with Chrome flags that disable or restrict third-party cookies, then migrate the affected flow using a custom domain for first-party cookies, the authorization code flow with refresh tokens, AuthJS offline access, or supported replacements for deprecated sessions/me endpoints. Re-test login, session extension, and session inspection behavior after implementation.

## Takeaways

- Chrome testing should check for developer-console errors, unexpected login prompts, and logout when a session is extended.
- A custom Okta domain can make session cookies first-party, but externally hosted sign-in resources may require Content Security Policy updates.
- AuthJS can use refresh tokens instead of cookies when offline\_access is enabled in both the authorization server and the application configuration.

## FAQ

### How can an application test whether third-party-cookie changes affect its Okta login flow?

In Chrome, enable chrome://flags#third-party-cookie-deprecation-trial and chrome://flags/#tracking-protection-3pcd, and disable chrome://flags/#tpcd-metadata-grants. Sign in with the self-hosted widget, exercise cookie-dependent features, and check for console errors, repeated prompts, or logout during session extension.

### What are the supported ways to remove the dependency on third-party cookies?

The guidance lists four options: configure a custom domain for first-party cookies, use the authorization code flow with refresh tokens, configure AuthJS for offline\_access, or replace deprecated sessions/me calls with supported endpoints and refresh-token or revocation mechanisms.

### Does Okta’s temporary third-party-cookie exemption provide a permanent solution?

No. An Okta-provided script can set a trial token that preserves third-party cookies for the login experience, but Google’s exemption ends at the end of 2024.

**Tags:** [Authentication](https://yomu.fyi/topic/authentication), [OAuth 2.0](https://yomu.fyi/topic/oauth-2-0), [Okta](https://yomu.fyi/topic/okta)

- Source: [Okta](https://developer.okta.com/blog/2024/04/08/third-party-cookies-okta-sign-in-widget)
- Source URL: https://developer.okta.com/blog/2024/04/08/third-party-cookies-okta-sign-in-widget
- Ingested by Yomu: 2026-09-17T14:06:33.069Z

[Read original post](https://developer.okta.com/blog/2024/04/08/third-party-cookies-okta-sign-in-widget)