# Any workadounds for Safari ITP issue with transaction cookie when using express-openid-connect? **URL:** \ **Category:** Get Help\ **Tags:** oidc, protocols\ **Created:** [November 4, 2024, 11:32am UTC](https://community.auth0.com/t/any-workadounds-for-safari-itp-issue-with-transaction-cookie-when-using-express-openid-connect/150940 "2024-11-04T11:32:07Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![mhautala](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/mhautala/32/33331_2.png) [@mhautala](https://community.auth0.com/u/mhautala)\ **Post date:** [November 4, 2024, 11:32am UTC](https://community.auth0.com/t/any-workadounds-for-safari-itp-issue-with-transaction-cookie-when-using-express-openid-connect/150940/1 "2024-11-04T11:32:07Z")
We have faced issue which seems to be related to Safari’s Intelligent Tracking Protection functionality when using express-openid-connect library. Safari may drop the transaction cookie auth\_verification when browser is redirected back to the client backend callback route in authorization code flow. The redirect from the oidc provider back to site is considered “cross-site” redirect and Safari in some occasions may decide to omit the otherwise valid 1st party auth\_verification cookie. This result to BadRequestError: checks.state argument is missing [error](https://github.com/auth0/express-openid-connect/issues/145). Is there any workaround for this when using express-openid-connect? It seems that implementing the custom session store (e.g. Redis) would not help as the transaction cookie is still used. Or have we understood this incorrectly? Notes: Our login page and the site share the same top-level domain e.g. [https://site.company.com](https://site.company.com) redirects to [https://login.company.com](https://login.company.com). We are using response\_type: code and response\_mode: query at site using express-openid-connect. ---
**Author:** ![marybeth.hunter](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/marybeth.hunter/32/61955_2.png) [@marybeth.hunter](https://community.auth0.com/u/marybeth.hunter)\ **Post date:** [November 6, 2024, 6:17pm UTC](https://community.auth0.com/t/any-workadounds-for-safari-itp-issue-with-transaction-cookie-when-using-express-openid-connect/150940/3 "2024-11-06T18:17:42Z")
Hi @mhautala! I recommend reviewing our doc [Troubleshoot Renew Tokens When Using Safari](https://auth0.com/docs/troubleshoot/authentication-issues/renew-tokens-when-using-safari)! There’s a section for workarounds you can take a look at 🙂 Additionally, please see this Community article discussing this Safari ITP issue: [Using Auth0 in Safari with ITP Enabled](https://community.auth0.com/t/using-auth0-in-safari-with-itp-enabled/123527) Please let me know if you have any additional questions after reviewing those links! Best, Mary Beth ---
**Author:** ![mhautala](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/mhautala/32/33331_2.png) [@mhautala](https://community.auth0.com/u/mhautala)\ **Post date:** [November 6, 2024, 6:38pm UTC](https://community.auth0.com/t/any-workadounds-for-safari-itp-issue-with-transaction-cookie-when-using-express-openid-connect/150940/4 "2024-11-06T18:38:13Z")
We are not using iframes or any kind of silent authentication. The issue happens in the callback (step 5.) of the normal redirect based authorization code flow where Safari drops the transaction cookie which express-openid-connect libary sets and needs in the callback handling: > **[Authorization Code Flow](https://auth0.com/docs/get-started/authentication-and-authorization-flow/authorization-code-flow)** > > Learn how the Authorization Code flow works and why you should use it for regular web apps. These ITP debug tips should be helpful though: > **[Troubleshoot Renew Tokens When Using Safari](https://auth0.com/docs/troubleshoot/authentication-issues/renew-tokens-when-using-safari#itp-debug-mode)** > > Issues with token renewal in Safari when ITP is enabled. ---
**Author:** ![mhautala](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/mhautala/32/33331_2.png) [@mhautala](https://community.auth0.com/u/mhautala)\ **Post date:** [November 12, 2024, 2:09pm UTC](https://community.auth0.com/t/any-workadounds-for-safari-itp-issue-with-transaction-cookie-when-using-express-openid-connect/150940/5 "2024-11-12T14:09:27Z")
This was a combination of configuration and user error 🤦‍♂️ Our site was not redirecting http → https and the user not noticing this (until now). So the authorization code flow being tested was: ```auto http://site.company.com -> https://login.company.com -> https://site.company.com/callback ``` and hence the auth\_verification cookie was being dropped ---
**Author:** ![marybeth.hunter](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/marybeth.hunter/32/61955_2.png) [@marybeth.hunter](https://community.auth0.com/u/marybeth.hunter)\ **Post date:** [November 12, 2024, 3:31pm UTC](https://community.auth0.com/t/any-workadounds-for-safari-itp-issue-with-transaction-cookie-when-using-express-openid-connect/150940/6 "2024-11-12T15:31:01Z")
@mhautala, Nice find! I’ve marked this as the solution to share with the rest of the Community! Have a great week! Thanks, Mary Beth ---
**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\ **Post date:** [November 26, 2024, 3:31pm UTC](https://community.auth0.com/t/any-workadounds-for-safari-itp-issue-with-transaction-cookie-when-using-express-openid-connect/150940/7 "2024-11-26T15:31:10Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.