Single sign-on loops on iPhones and Macs: Safari drops the session cookie on the SAML POST

Project: Engineering
Type: Bug
Status: Done Done
Priority: Highest
Organization: Parcelwise
Reporter: Yusuf Demir <yusuf.demir@acme-hq.example>
Assignee: Jonas Berg <jonas.berg@acme-hq.example>
Labels: parcelwisesingle-sign-on
Components: identity-service
Fix versions: identity-service 2026.09.15
Sprint: Sprint 51
Created: 9 Sep 2026, 09:55 UTC
Updated: 15 Sep 2026, 12:00 UTC
Resolved: 15 Sep 2026, 12:00 UTC

Description

Parcelwise's people at Eindhoven on iPhones and some Macs go round in a loop: Microsoft sign-in, back to ours, Microsoft again (SUP-1152). Windows is fine. Workaround: Chrome or Edge.

Steps to reproduce

iPhone, iOS 17.6, Safari. Depot on single sign-on.
Sign in through Entra ID.

Expected: signed in. Actual: back on our sign-in page, round again.

The session cookie on the assertion POST is SameSite=Lax; Safari leaves it out of the cross-site POST from Entra ID, so we start the sign-in again. That cookie needs SameSite=None; Secure.

Linked issues

relates to SUP-1152 Parcelwise: sign-in loops between Microsoft and ACME on iPhones and Macs Done

Comments (2)

Jonas Berg · 9 Sep 2026, 13:20 UTC

Confirmed in identity-service; fix in review. Affects any customer on iOS, not only Parcelwise.

Hanna Virtanen · 15 Sep 2026, 11:40 UTC

Verified on iOS 17.6 and Safari 17 on macOS, Entra ID and Okta test depots.