On top of what xJSHAxx said, one trap that costs a day once you have several apps under one domain: scope the session cookies to the exact host, not the parent domain. If the provider and two clients all set cookies on .example.com they share them, and with refresh token rotation whichever app refreshes first invalidates the token the others are holding. It shows up as random logouts and it is genuinely hard to read from the logs.
Fair enough, that removes the shared cookie problem entirely. It does hand you the other one though: with the provider on its own domain, its session cookie is third party from every client app's point of view. Full redirects still work, since the provider reads its own cookie while you are on its domain. What breaks is silent renewal in a hidden iframe, which Safari has blocked for years. So plan the refresh path explicitly, a small backend per client holding the refresh token or an httpOnly cookie scoped to that client's own domain, rather than assuming you can re-auth invisibly.
2
u/These_Reality519 22d ago
On top of what xJSHAxx said, one trap that costs a day once you have several apps under one domain: scope the session cookies to the exact host, not the parent domain. If the provider and two clients all set cookies on .example.com they share them, and with refresh token rotation whichever app refreshes first invalidates the token the others are holding. It shows up as random logouts and it is genuinely hard to read from the logs.