Navigational tracking

Safari: Intelligent Tracking Prevention – W3C Privacy CG draft

Firefox desktop: Enhanced Tracking Protection – Mozilla and W3C Privacy CG draft

Proposal Draft: when a user has no interaction with a site (at eTLD+1 level), limit cookies to an hour lifetime.

EVOLVING PRACTICE: FedCM is a possible signal to allow a more aggressive mitigation of bounce tracking while protecting SSO.

Authentication protocols use cross-site redirection with "link decoration" and POST to exchange information about the sites and the user.

While SSO is understood as a critical element, it is understood much more as a single bounce, consumer side authentication, without the many bounces to translate across protocls and implementations, nor is there understanding the trust models and authorization elements involved.

This is the main focus of REFEDS Working group interaction with the W3C groups.

• FedCM : a new way for an authentication token to be exchanged
  
• Cookies Having Independent Partitioned State (CHIPS, also know as Partitioned cookies) allows an iframe to set cookies that the iframe can retrieve across a specific top level site, but no other site – documentation from Mozilla and Chrome
•  Storage Access API  or Shared Storage API allows a site to ask a user to allow third party cookies for that site's use – documentation

Third party cookies are not needed at any protocol specification. However, some consumer authentication libraries embedded in various sites and apps use third party cookies.

Within SAML, identity federation, and higher ed, implementations of logout and of Seamless Access are effected. In Seamless Access, the "smart button" is not available without third party cookies and introduces additional clicks in the flow for sites using advanced integration.

Cross site request cookies (2021)

In a proposal shared in the W3C WebAppSec WG regarding "Standardizing Security Semantics of Cross-Site Cookies",  the authors note a pattern they call "Top-Level Cross-Site POST Requests."  The document recommends "Given the existing widespread usage and lack of clear alternatives, we recommend following the current state of the web and not blocking cross-site cookies in this scenario."

This applies to any SAML SP that has

1. integrates using the recommended POST binding of the SAML response  
2. uses SP initiated and saves state using cookies before sending the user for SAML authentication
3. and expects those cookies to be presented on the response in order to correlate the response to a session state with initial request parameters.

iCloud Private Relay (2021)

Apple's Private Relay for iCloud+ customers is a "lite" relay network used only with Safari and TCP Port 80 (aka http) traffic. All DNS requests are encrypted and go through Apple.

Campus networks that need users on the network to not go through a relays but to appear to originate from the network must make changes documented at "Prepare your network or web server for iCloud Private Relay" 

Systems that assume region or city level geoaccuracy when interpreting IP address may only get country level accuracy if the user chooses that setting in the relay configuration.