title: How should Single-Sign-On work if all browsers will prevent cross site tracking
body: <p>more and more modern browsers prevent cross-site tracking by default. For example, Safari, Firefox, Brave, they all use 'prevent cross-site tracking' as a default option. I analyzed our users and found out that 6% of them prevent cross-site tracking and have issues with authorization and refreshing tokens. But I'm sure that the percentage will grow. According to the news, Safari will keep preventing tracking by default.</p>
  
  <p>Maybe, it's a good thing to do, but it breaks the majority of Single-sign on implementations.</p>
  
  <p><strong>THE CASE</strong></p>
  
  <p>Assuming, we have a big international service that has one domain for one country: <code>site.com, site.ae, site.ru, site.ca, ...</code>. And we have SSO service on <code>sso.site.com</code> that follows three rules:</p>
  
  <ol>
  <li>A user logs in the SSO domain once</li>
  <li>A user is authorized on all domains</li>
  <li>His session doesn't expire because we save him logged in as long as possible (until he signs out someday, of course).</li>
  </ol>
  
  <p>SSO is awesome. It helps users. Users don't care about re-authorization. And it makes things easier for a company because there is only one authorization service. And you don't have to come up with another one for a new service.</p>
  
  <p><strong>How do modern SSO implementations (i.e. Auth0, stackauth e.t.c) achieve this?</strong></p>
  
  <p>They store tokens (access, refresh, JWT, doesn't matter) in cookies with the SSO domain <code>sso.site.com</code>. When a user opens <code>site.ae or site.ca</code>, for example, his user agent sends a request to the SSO, and the SSO checks his credentials stored in cookies, actualizes them (if necessary) and sends back the response, and then the app asks for user's data to another backend e.t.c.</p>
  
  <p><strong>THE PROBLEM</strong></p>
  
  <p>But it's not possible to do if user agents prevent cross-site cookies by default. Cause the SSO cookies won't be sent from another domain (i.e. <code>site.ae</code>) except for <code>site.com</code> since the SSO exists on <code>sso.site.com</code></p>
  
  <p>We may not use cookies in the near future. Yeah, we can use a chain of redirects though. Just imagine if you have hundreds of domains and ten milliseconds for each redirect! It slows the performance and user experience. </p>
  
  <p>So my question is how can we login users and keep them authorized on many domains in the world when all browsers prevent cross-site tracking?</p>