We are experiencing what seems to be a bug related to the new "Prevent cross-site tracking" feature in our application. The scenario is this: User is logged into our application, which uses cookies and traditional sessions for authorization. Our app opens an <iframe> to a 3rd party src (that happens to be a secure payment form for entering confidential payment information). The payment information is submitted to the third party form using no cookies at all. Once processing is finished, the third party's server responds with a 302 (or 303, we've tried both) redirecting the <iframe> back to the 1st party's domain. The <iframe> sends a request to the 1st party domain (matching the top level window's domain), but no cookies are sent along with the redirected request, so the request is seen as unauthorized, since the session cannot be found. We have no issues with any other browsers and did not have issues with Safari until the recent updates.
<rdar://problem/62627006>
Hi! Thanks for filing! We’re always interested in hearing from developers about our changes. What you’re reporting is not a bug. See “Cookie Blocking Latch Mode” in our latest blog post: https://webkit.org/blog/10218/full-third-party-cookie-blocking-and-more/
This is behaving properly.