I am aware of an issue regarding cookies when my extension is used in a cross-origin context. Using the extension in such a context has so far been unsupported (see requirements in documentation), but it was mostly working.
Up until recently, only global login would be unavailable on cross-origin, but connecting and disconnecting from Flarum side would work.
Now with Chrome defaulting cookies to SameSite=Lax
, cross-origin iframes can no longer access Flarum session cookies, which means the iframe comments has effectively become read-only and it's impossible to connect or interact with Flarum inside of it.
The upcoming Flarum beta 14 will also mark Flarum cookies explicitely as SameSite=Lax
, which means this behavior will be experienced across all browsers.
As I said this should only affect users that were using my extension in an already unsupported manner. But if you are affected and have suggestions regarding the handling of cookies, feedback is welcome.
I could offer an option to force Flarum cookies to use SameSite=None
, but that seems counter-productive for security. Especially since my extension still wouldn't fully support global login for such setups.
My recommendation continues to be to only use this extension for contexts where Wordpress and Flarum share a common origin.