fix: Safari mobile auth - change sameSite to none for cross-site OAuth by adrianhajdin · Pull Request #116 · adrianhajdin/banking

adrianhajdin · 2026-02-17T18:59:34Z

Fixes #247

Problem

Safari on iOS 17+ blocks cookies with sameSite="strict" during OAuth redirects from external providers (Google). This causes the session cookie to be dropped, resulting in users being redirected back to /sign-in in a loop after completing authentication.

Solution

Changed sameSite from "strict" to "none" in both signIn() and signUp() functions.

Safety

Cookies already use httpOnly=true and secure=true
sameSite="none" is safe when paired with secure=true
This allows cookies to survive cross-site redirects while maintaining security

Testing

Should be tested on:

Mobile Safari iOS 17+
OAuth flow with Google sign-in
Verify redirect to /dashboard after auth

cc @NicholasDev

Summary by CodeRabbit

Bug Fixes
- Updated cookie behavior to support cross-site functionality, enabling improved compatibility with external services and third-party integrations.

Fixes #247 Safari on iOS 17+ blocks cookies with sameSite='strict' during OAuth redirects from external providers (Google). This causes the session cookie to be dropped, resulting in a redirect loop back to /sign-in. Changes: - Update cookie sameSite from 'strict' to 'none' in signIn() - Update cookie sameSite from 'strict' to 'none' in signUp() The cookies already use httpOnly=true and secure=true, making sameSite=none safe for cross-site authentication flows.

vercel · 2026-02-17T18:59:38Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
banking	Error		Feb 17, 2026 7:00pm

coderabbitai · 2026-02-17T18:59:57Z

📝 Walkthrough

Walkthrough

The pull request modifies cookie security settings in user authentication actions. The sameSite attribute for the appwrite-session cookie is changed from "strict" to "none" in two locations where cookies are set during sign-in and sign-up operations.

Changes

Cohort / File(s)	Summary
Cookie Configuration `lib/actions/user.actions.ts`	Changed sameSite attribute from "strict" to "none" for appwrite-session cookie in sign-in and sign-up flows, relaxing cross-site cookie restrictions while maintaining httpOnly and secure flags.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Poem

🐰 Hop, hop, cookies dance cross the site,
From strict walls to freedom's light,
No restrictions on their way,
Rabbits celebrate today! 🍪✨

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'fix: Safari mobile auth - change sameSite to none for cross-site OAuth' directly and accurately summarizes the main change: modifying the sameSite cookie attribute from strict to none to fix Safari mobile authentication issues with OAuth.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

📝 Generate docstrings

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment
Commit unit tests in branch fix/safari-auth-cookie

Tip

Issue Planner is now in beta. Read the docs and try it out! Share your feedback on Discord.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

coderabbitai

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@lib/actions/user.actions.ts`:
- Around line 95-100: Update the cookie's SameSite setting from "none" to "lax"
in the cookies().set call that sets the "appwrite-session" cookie; locate the
cookies().set(...) invocation in lib/actions/user.actions.ts (the block that
sets path, httpOnly, sameSite, secure) and change sameSite: "none" to sameSite:
"lax" so it matches the signIn behavior and maintains consistent cookie policy.
- Around line 40-45: Update the cookie SameSite policy in the session setter to
use "lax" instead of "none": locate the cookies().set(...) call in
user.actions.ts (the session creation/assignment logic where session.secret is
stored) and change sameSite from "none" to "lax" while preserving path,
httpOnly, and secure flags so OAuth top-level redirects still work but
cross-site subrequests are blocked.

coderabbitai · 2026-02-17T19:01:55Z

    cookies().set("appwrite-session", session.secret, {
      path: "/",
      httpOnly: true,
-      sameSite: "strict",
+      sameSite: "none",
      secure: true,
    });


⚠️ Potential issue | 🟠 Major

Prefer sameSite: "lax" over "none" — it fixes Safari OAuth redirects without opening up CSRF surface.

sameSite: "none" causes the browser to attach the session cookie to every cross-site request (iframes, fetch, form POSTs from third-party pages, etc.), which is unnecessary exposure for a banking app. OAuth redirect flows are top-level navigations, and sameSite: "lax" already allows cookies on those while still blocking cross-origin subrequests.

"lax" is the recommended setting for exactly this scenario — surviving OAuth/SSO redirects without degrading CSRF protection.

Proposed fix

cookies().set("appwrite-session", session.secret, { path: "/", httpOnly: true, - sameSite: "none", + sameSite: "lax", secure: true, });

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

cookies().set("appwrite-session", session.secret, {

path: "/",

httpOnly: true,

sameSite: "strict",

sameSite: "none",

secure: true,

});

cookies().set("appwrite-session", session.secret, {

path: "/",

httpOnly: true,

sameSite: "lax",

secure: true,

});

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed. In `@lib/actions/user.actions.ts` around lines 40 - 45, Update the cookie SameSite policy in the session setter to use "lax" instead of "none": locate the cookies().set(...) call in user.actions.ts (the session creation/assignment logic where session.secret is stored) and change sameSite from "none" to "lax" while preserving path, httpOnly, and secure flags so OAuth top-level redirects still work but cross-site subrequests are blocked.

coderabbitai · 2026-02-17T19:01:55Z

    cookies().set("appwrite-session", session.secret, {
      path: "/",
      httpOnly: true,
-      sameSite: "strict",
+      sameSite: "none",
      secure: true,
    });


⚠️ Potential issue | 🟠 Major

Same sameSite concern as in signIn — use "lax" here too.

Apply the same change as suggested for signIn above.

Proposed fix

cookies().set("appwrite-session", session.secret, { path: "/", httpOnly: true, - sameSite: "none", + sameSite: "lax", secure: true, });

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

cookies().set("appwrite-session", session.secret, {

path: "/",

httpOnly: true,

sameSite: "strict",

sameSite: "none",

secure: true,

});

cookies().set("appwrite-session", session.secret, {

path: "/",

httpOnly: true,

sameSite: "lax",

secure: true,

});

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed. In `@lib/actions/user.actions.ts` around lines 95 - 100, Update the cookie's SameSite setting from "none" to "lax" in the cookies().set call that sets the "appwrite-session" cookie; locate the cookies().set(...) invocation in lib/actions/user.actions.ts (the block that sets path, httpOnly, sameSite, secure) and change sameSite: "none" to sameSite: "lax" so it matches the signIn behavior and maintains consistent cookie policy.

vercel Bot had a problem deploying to Preview February 17, 2026 19:00 Failure

coderabbitai Bot reviewed Feb 17, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: Safari mobile auth - change sameSite to none for cross-site OAuth - #116

fix: Safari mobile auth - change sameSite to none for cross-site OAuth#116
adrianhajdin wants to merge 1 commit into
mainfrom
fix/safari-auth-cookie

adrianhajdin commented Feb 17, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

vercel Bot commented Feb 17, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Feb 17, 2026 •

edited

Loading

Walkthrough

Changes

Estimated code review effort

Poem

Uh oh!

coderabbitai Bot left a comment

Uh oh!

coderabbitai Bot Feb 17, 2026

Uh oh!

coderabbitai Bot Feb 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

adrianhajdin commented Feb 17, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Problem

Solution

Safety

Testing

Summary by CodeRabbit

Uh oh!

vercel Bot commented Feb 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Feb 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Poem

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot Feb 17, 2026

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot Feb 17, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

adrianhajdin commented Feb 17, 2026 •

edited by coderabbitai Bot

Loading

vercel Bot commented Feb 17, 2026 •

edited

Loading

coderabbitai Bot commented Feb 17, 2026 •

edited

Loading