Loading post…
OktaE. DunhamExplainer
The End of Third
Summary
The post explains how browser phaseouts of third-party cookies can affect Okta authentication patterns and session features. Third-party cookies are issued by other domains and can support cross-site session introspection, federated login-related behavior, and convenience features, but browsers increasingly restrict them because of security and privacy concerns. Most Okta core authentication flows do not require them; however, applications using an Okta session across different top-level domains, customer-hosted sign-in experiences, ADSSO, and certain “remember me” functions may lose session introspection or extension while basic authentication and token return remain possible. The post recommends testing with Chrome’s third-party cookies disabled, using feature flags, and migrating away from these cookies before Google’s stated exemption ends in 2024.
Context
The guidance addresses Okta applications that use cookies across domains, including session introspection, customer-hosted sign-in experiences, Agentless Desktop Single Sign-on, and “remember me” features. It notes that Google provided an update to its deprecation effort and that Okta would assess the specific impact on customers.
Approach / What changed
Test applications with Chrome’s feature flags configured to simulate third-party cookie deprecation, then identify affected deployment patterns and migrate away from third-party cookies. The post also recommends using a custom domain aligned with the application’s top-level domain where applicable, and following the specified CookiesAllowedforURLs steps for ADSSO deployments.
Takeaways
Most Okta core authentication flows do not rely on third-party cookies, so users can still authenticate and receive tokens even when some cookie-dependent features stop working.
Different top-level domains can prevent applications from introspecting or extending an Okta session; hosting the sign-in experience on the same top-level domain avoids that stated impact.
Remember Last Used Factor, Okta Identity Engine’s “keep me signed in,” and Okta Classic’s “Remember me” can use third-party cookies when domains differ.
FAQ
What continues to work when third-party cookies are blocked?
Authentication remains possible, and tokens are still returned because those functions do not rely on cookies. Users may need to re-authenticate more often, and cookie-dependent session features may be affected.
How can an application test the future browser behavior?
Chrome feature flags can simulate how Okta’s third-party cookies will be treated after the exemption ends. The post recommends testing the application as soon as possible to allow time for testing and unforeseen issues.
When does hosting the sign-in experience avoid the stated impact?
If the sign-in experience is hosted on the same top-level domain as the application, third-party cookie deprecation will not affect its behavior. A separate top-level domain can break session introspection and extension, although authentication and token return remain possible.
Source and freshness
- Source
- developer.okta.com
- Published
- Added to Yomu
Summaries are generated from the original by a language model. Check the original before relying on it.
Keep reading
Related reading
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
The best engineering reads, once a week
One useful email. Unsubscribe anytime.