If third-party cookies are disabled in the browser settings, certain functionality of the Okta Sign-In Widget may not work as expected. This article will explain options for mitigating this.

• Sign-in Widget
• Chrome/Firefox
• Okta Classic Engine

If Third Party Cookies are disabled in a browser then any SPA set up to run the Embedded Okta Sign-In Widget will be unable to SSO if the user already has an Okta session unless refresh tokens are enabled. The reason for this is that the default configuration of the Sign-In Widget uses a hidden iFrame to pass the sessionToken to the OAuth endpoint. This is where the user's session cookie is set in the browser. In this case, it would be set in the iFrame, which is what "Disallow Third Party Cookies" disables. Since the session cookie is not set in the iFrame, the refreshing of the token or a call to check the user's session status would fail with an OAUTH_ERROR message.

There are three options to resolve this:

• Use the redirect option 

The Widget will redirect to our OAuth /authorize endpoint, the session cookie gets set in a first-party context, and then Okta will redirect back to the app (instead of silently opening the hidden iframe and exchanging the sessionToken in the same page). This can be done by setting authParams.display to page (as described in okta-signin-widget documentation).

• Use a custom domain 

If the issuer for the SPA is set to the Custom Okta Domain and the app is hosted on the same domain, this will eliminate the third-party context.

• • For example, if the app is hosted on https://app.company.com/ and the Okta Custom Domain is https://org.company.com/, this would eliminate the issue.
    
    
• Make users enable Third Party Cookies

This is not recommended because major browsers like Chrome, Firefox, and Safari are removing third-party cookie support. For more information, refer to Deprecation of Third-Party Cookies in Google Chrome.

Related References

• Okta Auth JS methods that rely on third-party cookies
• Okta Developer Blog Post - How to Prepare Your Self-Hosted Okta Sign-in Widget to Work without Third-Party Cookies
• Okta deployment models - redirect vs. embedded