Safari 13+ iframe blocks CORS cookies
问题 Safari flat out doesn't let you set cookies in iframes of domains different than the parent domain, server-side CORS headers be damned. To clarify: user is on domainA.com. An iframe for domainB.com is open, and attempts to authenticate the user on domainB.com inside the iframe. Set-Cookie header is returned from the server inside the domainB.com iframe, with all the required headers, but Safari isn't sending it back in subsequent calls. An old workaround was doing a form submit from the