Skip to content

fix: Safari mobile auth - change sameSite to none for cross-site OAuth #116

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
adrianhajdin wants to merge 1 commit into
base: main
Choose a base branch
from
Open

fix: Safari mobile auth - change sameSite to none for cross-site OAuth #116

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions lib/actions/user.actions.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,7 +40,7 @@ export const signIn = async ({ email, password }: signInProps) => {
cookies().set("appwrite-session", session.secret, {
path: "/",
httpOnly: true,
sameSite: "strict",
sameSite: "none",
secure: true,
});
Comment on lines 40 to 45

@coderabbitai coderabbitai Bot Feb 17, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Prefer sameSite: "lax" over "none" — it fixes Safari OAuth redirects without opening up CSRF surface.

sameSite: "none" causes the browser to attach the session cookie to every cross-site request (iframes, fetch, form POSTs from third-party pages, etc.), which is unnecessary exposure for a banking app. OAuth redirect flows are top-level navigations, and sameSite: "lax" already allows cookies on those while still blocking cross-origin subrequests.

"lax" is the recommended setting for exactly this scenario — surviving OAuth/SSO redirects without degrading CSRF protection.

Proposed fix 
     cookies().set("appwrite-session", session.secret, {
       path: "/",
       httpOnly: true,
-      sameSite: "none",
+      sameSite: "lax",
       secure: true,
     });
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
cookies().set("appwrite-session", session.secret, {
path: "/",
httpOnly: true,
sameSite: "strict",
sameSite: "none",
secure: true,
});
cookies().set("appwrite-session", session.secret, {
path: "/",
httpOnly: true,
sameSite: "lax",
secure: true,
});
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@lib/actions/user.actions.ts` around lines 40 - 45, Update the cookie SameSite
policy in the session setter to use "lax" instead of "none": locate the
cookies().set(...) call in user.actions.ts (the session creation/assignment
logic where session.secret is stored) and change sameSite from "none" to "lax"
while preserving path, httpOnly, and secure flags so OAuth top-level redirects
still work but cross-site subrequests are blocked.


Expand Down Expand Up @@ -95,7 +95,7 @@ export const signUp = async ({ password, ...userData }: SignUpParams) => {
cookies().set("appwrite-session", session.secret, {
path: "/",
httpOnly: true,
sameSite: "strict",
sameSite: "none",
secure: true,
});
Comment on lines 95 to 100

@coderabbitai coderabbitai Bot Feb 17, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Same sameSite concern as in signIn — use "lax" here too.

Apply the same change as suggested for signIn above.

Proposed fix 
     cookies().set("appwrite-session", session.secret, {
       path: "/",
       httpOnly: true,
-      sameSite: "none",
+      sameSite: "lax",
       secure: true,
     });
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
cookies().set("appwrite-session", session.secret, {
path: "/",
httpOnly: true,
sameSite: "strict",
sameSite: "none",
secure: true,
});
cookies().set("appwrite-session", session.secret, {
path: "/",
httpOnly: true,
sameSite: "lax",
secure: true,
});
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@lib/actions/user.actions.ts` around lines 95 - 100, Update the cookie's
SameSite setting from "none" to "lax" in the cookies().set call that sets the
"appwrite-session" cookie; locate the cookies().set(...) invocation in
lib/actions/user.actions.ts (the block that sets path, httpOnly, sameSite,
secure) and change sameSite: "none" to sameSite: "lax" so it matches the signIn
behavior and maintains consistent cookie policy.


Expand Down