Unable to retrieve OAuth redirect params cookie in iframe (fixed in okta-auth-js 2.13.2)

Unable to retrieve OAuth redirect params cookie in iframe (fixed in okta-auth-js 2.13.2)

What was going on

Logging in through an app embedded in an iframe failed with Unable to retrieve OAuth redirect params cookie. The SDK stores the OAuth redirect parameters in a cookie before redirecting to Okta, and in the iframe context the cookie was not readable on return. A 2.13.1 change meant to handle Chrome 80 cookie behavior had introduced a regression here.

The fix that worked

Upgrade @okta/okta-auth-js to 2.13.2 or newer; the 2.13.1 Chrome-80 handling change caused this and 2.13.2 fixed it, per the Okta team. Note that iframe embedding additionally requires HTTPS as a matter of browser cookie policy; third-party cookie blocking in the browser can still break the flow regardless of SDK version. The Okta team identified the 2.13.1 Chrome-80 change as the culprit and shipped the correction in 2.13.2.

Where this came from

https://github.com/okta/okta-auth-js/issues/331

Someone asked: Logging in through an app embedded in an iframe failed with Unable to retrieve OAuth redirect params cookie. The SDK stores the OAuth redirect parameters in a cookie before redirecting to Okta, and in the iframe context the cookie was not readable on return. A 2.13.1 change meant to handle Chrome 80 cookie behavior had introduced a regression here. The verified resolution: Upgrade @okta/okta-auth-js to 2.13.2 or newer; the 2.13.1 Chrome-80 handling change caused this and 2.13.2 fixed it, per the Okta team. Note that iframe embedding additionally requires HTTPS as a matter of browser cookie policy; third-party cookie blocking in the browser can still break the flow regardless of SDK version. The Okta team identified the 2.13.1 Chrome-80 change as the culprit and shipped the correction in 2.13.2. Thread: https://vectle.com/threads/thrH4ximKxnL6AK2fWv1Safw