Third-Party Cookies Blocked in Safari, Preventing Copilot Usage

[haidersultancrewlogix]

Description

Safari blocks third-party cookies by default, which prevents Copilot from functioning properly. The issue also occurs in Chrome's Private mode and when the "Block Third-Party Cookies" option is enabled in any browser.

Steps to Reproduce

1. Enable authentication on the Chainlit backend.
2. Embed Copilot on an HTML page.
3. Open the page in Safari, a Private tab in Chrome, or any browser with "Block Third-Party Cookies" enabled.
4. Check the /jwt API response.
5. Error Message:
   "This attempt to set cookie via Set-Cookie header was blocked due to user preferences."

Expected Behavior

The UI should display a clear message prompting users to allow third-party cookies instead of showing a blank screen.

Actual Behavior

• Blank screen with no error message or instructions.
• Error occurs while setting a cookie via the /jwt API.

Screenshots

Blank Screen (No Error Message or Guide):

Error while setting cookie:

Environment Details

Desktop:

• OS: Ubuntu / Windows / macOS
• Browser: Chrome / Firefox / Safari
• Version: All versions

Smartphone:

• Device: Android / iPhone
• Browser: Chrome / Firefox / Safari
• Version: All versions

[willydouhard]

Currently all authentication is handled by cookies. Changing this would be a significant change

[haidersultancrewlogix]

I think we can still use Cookies for Authentication. When we allow third-party cookies from the browser settings the Copilot starts working. Maybe an error message in UI that can prompt users to allow third-party cookies if they have them blocked?

[willydouhard]

That would be great, open to a contribution!

[asvishnyakov]

@willydouhard
I think this issue is much more serious when anyone thought. If you embed chainlit into your site from different domain (i.e. original is example.com, chainlit is on example.org) this will make cookie "third-party" and by so make chainlit authentication not accessable for Safari users and any other browser with third-party cookie blocked. Why do you switched to cookies at first place?

[asvishnyakov]

@haidersultancrewlogix @willydouhard In case it helps someone, here's what I found while trying to resolve an issue with embedding Chainlit in an iframe:

• You can request permission to use third-party cookies via the Storage Access API (though I wasn’t able to get it working for my case).
• You can use partitioned cookies, which turned out to be exactly what I needed.

[asvishnyakov]

Since Safari disabled partitioned cookies in version 18.5 and has no plans to re-enable them (even worse — there's a regression causing such cookies to be completely ignored instead of being treated as first-party), I think this issue has become more important. We should prioritize it and consider switching away from cookies to storing the JWT token in a different type of storage.

@hayescode Spent my last few work days fighting with this

[github-actions]

This issue is stale because it has been open for 14 days with no activity.

[asvishnyakov]

@hayescode This seems like one of the most important issues after switching back to cookies, so I’ve added the keep-for-a-while label.

[jdb78]

Generally, chainlit doesn't work anymore for me on Safari incl normal (not copilot) mode. That includes all browsers on the iPhone.

[asvishnyakov]

@jdb78 The only working workaround now is to place it on same domain or subdomain of the site where you use it