TL;DR: partitioned cookies do not consider previous browser redirections.
Our product is a script that embeds into the host-app.
Customers run the script that loads resources from other domain and renders them inside their app.
If the user is not authorised to get the resource he is redirected to our product's login page, authorises via credentials or SSO provider and is sent back to the host. Like: window.location.href = 'product.login/auth?return_to=host-app'.
When we implemented partitioned cookies, the 'partition key' is set to the actual product.login domain who issued the cookie, without considering previous redirects, declined by the host-app and going to the infinite redirect loop.
How can I get to get to the "product.login page" so the browser considered the host-app as the rightful issuer of the authorisation cookie ? Is there a way to tell the browser the correct top-level context of the cookie ?
TL;DR: partitioned cookies do not consider previous browser redirections.
Our product is a script that embeds into the host-app.
Customers run the script that loads resources from other domain and renders them inside their app.
If the user is not authorised to get the resource he is redirected to our product's login page, authorises via credentials or SSO provider and is sent back to the host. Like:
window.location.href = 'product.login/auth?return_to=host-app'.When we implemented partitioned cookies, the 'partition key' is set to the actual product.login domain who issued the cookie, without considering previous redirects, declined by the host-app and going to the infinite redirect loop.
How can I get to get to the "product.login page" so the browser considered the host-app as the rightful issuer of the authorisation cookie ? Is there a way to tell the browser the correct top-level context of the cookie ?