Sharing cookies across .test sub-domains in Safari 13 not possible

Question

I have a self-certificate for apache for https://example.test & https://m.example.test

When browsing https://m.example.test cookies are set to the base domain '.example.test' using php 'session.cookie_domain'. This DOES work in Chrome, Firefox or Safari up-to-version-12. However, it does not work anymore in Safari 13 (iOS 13 or Catalina).

What's even more strange is that the cookie is still set to the base domain on Safari 13 with my production machine for https://example.COM & https://m.example.COM

I have the same apache server configuration for both the COM and TEST servers. It simply stopped working on my development ".test" server after updating my iOS devices to iOS 13 or in MacOS after Catalina. Chrome, Firefox still work. Even old iOS devices connecting to my development machine (through a proxy) still store the cookie to the base domain ".example.test". So it looks like it is something specific to Safari 13 and only in ".test" domains.

I have created new certificates for my .TEST server using latest recommendations from Apple (max 825 days and so on) but it did not make any difference. It looks like something may have changed with self-signed certificates. Or perhaps a new rule exists for ".test" (not public) domains? It's something either specific to Safari, ".test" not-public-domains or certificates. Or something else I did not even think about.

Any idea how to configure Apache/Macosx/certificates so that I can still share a cookie across subdomains using Safari 13 in development .test domains? Thanks.

Answer 1

This is not an issue with certificates, but it seems to be a difference in how Safari parses the .test TLD.

We solved this by setting the cookie explicitly for each subdomain we need. In our Rails app, in the development environment, we set up the session store like this:

config.session_store(
  :active_record_store,
  key: 'our_app_session',
  domain: ['ourapp.test', 'api.ourapp.test', 'help.ourapp.test']
)

If you can figure out the way to do the same thing in your backend, you should be able to use the same cookie for your different .test subdomains.

Answer 2

I had the same problem with wildcard subdomains and cookies for the .test tld. It worked in Chrome, but Safari 13 did not set the cookie.

My workaround was to use .local instead. This worked in Safari too.

(Specifying each subdomain separately like @gueorgui suggested does not work as expected, because the browser will set a separate cookie for each subdomain)