Cross Domain localstorage does not work in Safari

[rahiparikh]

I was going through an article written by Daniel Brain on Medium.com that explains how to use POST-ROBOT to perform cross-domain localstorage. The code works for all browsers except safari.

See attached file for sample code. (Change extension from LOG to HTML).

receiver.log
sender.log

[bluepnume]

Hi! Yeah I wrote that article -- what specifically didn't work?

[rahiparikh]

@bluepnume If you try the test files in safari, you would notice that localstorage is being set within the frame. However, localstorage available to the frame is sandboxed and the values stored via iFrame are not exposed to any other page loaded from the domain of the iFrame.

Reproduction Steps:

1. Download the attached files and rename them to have .html extension.
2. Create a loopback interface for 127.0.0.2.
3. Edit hosts file and point 127.0.0.1 to domain1.example.com and 127.0.0.2 to domain2.example.com.
4. Start two HTTP Servers/Listeners (using python or something) to listen on both loopback addresses on port 3030 and move the downloaded files to webroot.
5. Navigate to http://domain1.example.com:3030/sender.html in safari.
6. Observe the value of localstorage in safari. You should notice a value being set.
7. Navigate to http://domain2.example.com:3030/receiver.html in safari.
8. Observe the value of localstorage in safari. You should not see the value that you saw in step 6.

[bluepnume]

Yeah, you seem to be right. I actually got your demo working, but I had to select "Always allow" in safari's cookie and website data policy:

I guess my advice would be to try to keep the store in the parent window, if possible, so it's always in a first-party context.

[JamieSellars]

@rahiparikh @bluepnume

did you have any luck getting this to work?

[rahiparikh]

Jamie, Unfortunately, I couldn't find a hack to get it working in Safari.

…

-- Rahil

On Wed, Feb 14, 2018 at 10:41 PM, Jamie Sellars ***@***.***> wrote: @rahiparikh <https://github.com/rahiparikh> @bluepnume <https://github.com/bluepnume> did you have any luck getting this to work? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#37 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ABy8NUreH2vkQaqi3lpWVpKOb0aFyHL7ks5tU6digaJpZM4QWUUO> .

[andrebautista]

I was hoping this library would solve my current issues around cross domain cookie/local storage tracking, however it looks like safari will continue to haunt me. Expecting users to check "always allow" in the settings isn't exactly something you can rely on. The default safari setting "Allow from websites I visit", means that you'd first have to visit your iframe'd url in order to have cookies/local storage accessible from the parent website. Google, Facebook, and the other big hitters are able to accomplish this because most of us regularly visit their websites so their cookies can follow us wherever we go.