Safari isn't saving cookies, but Chrome is

Question

UPDATE: It's worth mentioning, my website is being loaded via an iframe.

Here's my cookieSession in my app.js:

app.use(cookieParser());

app.use(cookieSession({
  secret: "SECRET_SIGNING_KEY",
  maxAge: 15724800000
}));

I then try to set the user, and token when logging in.

app.post('/login', function(req, res){

   Parse.User.logIn(req.body.username, req.body.password).then(function(user) {
      req.session.user = user;
      req.session.token = user.getSessionToken();
      res.redirect('/dashboard');
    }, function(error) {
      console.log(error)
      req.session = null;
      res.render('login');
    });

});

This works in Chrome but it doesn't work in Safari.

I've checked the Safari storage via the web console and under my domain there is nothing being saved.

Any reason why it's not working?

Answer 1

It looks like you hit a Safari bug here (https://bugs.webkit.org/show_bug.cgi?id=3512); You are redirecting any visiting browser to /dashboard while setting the cookie at the same time, and Safari is ignoring the Set-Cookie header when encountering the 302( or 301 I thing so) HTTP status. In this case you need keep user token in a variable an put it to /dashboard controller then recheck and store user token in req.session.

• Updated: Post your token (genereted by login controller) to dashboard controller

app.post('/login', function(req, res) {
    Parse.User.logIn(req.body.username, req.body.password).then(function(user) {
        res.redirect('/dashboard?token=' + user.getSessionToken() + '&user=' + user);
    }, function(error) {
        console.log(error)
        req.session = null;
        res.render('login');
    });

});


app.post('/dashboard', function(req, res) {
    if (req.query.user && req.query.token) {
        // save for first time
        req.session.user = req.query.user;
        req.session.token = req.query.user;
    }
  // check token in session before go

});

Answer 2

If you page is loaded in an iframe, the end user may choose to block Third Party Cookies which would prevent your website from writing the cookie.

See Safari Privacy Settings. for more info

Did you try to see if the cookie worked when the page was visited directly instead of an iframe?