title: Cross domain Cookies not working on Safari
body: <p>I have 2 websites:</p>
  <ol>
  <li>3rdpartycookiemanager.com</li>
  <li>website.com</li>
  </ol>
  <p>From website: <a href="https://www.website.com" rel="nofollow noreferrer">https://www.website.com</a></p>
  <p>I do an <strong>Ajax</strong> call to: <a href="https://www.3rdpartycookiemanager.com/cookies.php" rel="nofollow noreferrer">https://www.3rdpartycookiemanager.com/cookies.php</a></p>
  <p>with the following <strong>jQuery</strong> call:</p>
  <pre><code>$.ajax({
    ...
    type: 'POST',    
    url: 'https://www.3rdpartycookiemanager.com/cookies.php',
    cache: false,
    crossDomain: true,
    dataType: 'json',
    data: {
      email: 'bill.gates@microsoft.com'
    },
    xhrFields: {
      withCredentials: true
    },
    ...
  });
  </code></pre>
  <p>On the <strong>Developer Tools</strong> of the browser I see the following:</p>
  <pre><code>General
      Request URL:https://www.3rdpartycookiemanager.com/cookies.php
      Request Method:POST
      Status Code:200 
  
  Response Headers
      Access-Control-Allow-Credentials:true
      Access-Control-Allow-Origin:https://www.website.com
      Content-Type:application/json
      Date:Thu, 22 Oct 2020 16:47:32 GMT
      Server:
      Set-Cookie:data=%7B%22email%22%3A%22bill.gates%40microsoft.com%22%7D; expires=Fri, 22-Oct-2021 16:47:32 GMT; Max-Age=31536000; path=/; secure; SameSite=None
      Vary:Origin
      Provisional headers are shown
  
  Request Headers
      Accept:application/json, text/javascript, */*; q=0.01
      Content-Type:application/x-www-form-urlencoded; charset=UTF-8
      Origin:https://www.website.com
      Referer:https://www.website.com/
      User-Agent:Mozilla/5.0 (iPhone; CPU iPhone OS 13_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1
  
  Form Data
      action:set
      data[email]:bill.gates@microsoft.com
  </code></pre>
  <p>where on the <strong>Response Headers</strong> you can see this:</p>
  <pre><code>Set-Cookie:data=%7B%22email%22%3A%22bill.gates%40microsoft.com%22%7D; expires=Fri, 22-Oct-2021 16:47:32 GMT; Max-Age=31536000; path=/; secure; SameSite=None
  </code></pre>
  <p><strong>My problem is:</strong></p>
  <p>This works on:</p>
  <ul>
  <li>Windows - Edge, Chrome, Firefox</li>
  <li>Android - Chrome, Firefox</li>
  <li>macOS - Chrome, Firefox</li>
  </ul>
  <p><strong>But</strong> doesn't work on:</p>
  <ul>
  <li>macOS - Safari</li>
  <li>iOS - Safari, Chrome</li>
  </ul>
  <p><strong>Extra notes:</strong></p>
  <p>On website: <strong>3rdpartycookiemanager.com</strong> I use <strong>PHP</strong> and have the following:</p>
  <p><strong>~/public_html/3rdpartycookiemanager.com/.htaccess</strong></p>
  <pre><code># ----------------------------------------------------------------------
  # Allow loading of external fonts
  # ----------------------------------------------------------------------
  &lt;FilesMatch &quot;cookies\.php$&quot;&gt;
      &lt;IfModule mod_headers.c&gt;
          SetEnvIf Origin &quot;http(s)?://(www\.)?(website.com)$&quot; AccessControlAllowOrigin=$0
          Header add Access-Control-Allow-Origin %{AccessControlAllowOrigin}e env=AccessControlAllowOrigin
          Header add Access-Control-Allow-Credentials true
          Header merge Vary Origin
      &lt;/IfModule&gt;
  &lt;/FilesMatch&gt;
  </code></pre>
  <p><strong>~/public_html/3rdpartycookiemanager.com/cookies.php</strong></p>
  <pre><code>&lt;?php
  
  $action = $_POST['action'] ?? '';
  
  switch ($action) {
    case 'set':
      $data = $_POST['data'] ?? '';
      $arr_cookie_options = [
        'expires' =&gt; time() + 365*24*60*60,
        'path' =&gt; '/',
        // 'domain' =&gt; '.local',
        'samesite' =&gt; 'None',   // required to enable cross-site usage
        'secure' =&gt; true,       // required in order to use: 'samesite' =&gt; 'None'
        'httponly' =&gt; false
      ];
      setcookie('data', json_encode($data), $arr_cookie_options);
      $response = [
        'status' =&gt; 'success',
      ];
      break;
    case 'get':
      $response = json_decode($_COOKIE['data'] ?? '', true);
      break;
  }
  
  header('Content-Type: application/json');
  echo json_encode($response);
  
  ?&gt;
  </code></pre>
  <p>Any idea on how to make this work on:</p>
  <ul>
  <li>macOS - Safari</li>
  <li>iOS - Safari, Chrome</li>
  </ul>
  <p>as it works on the rest of the Devices and Browsers?</p>
  <p>Thanks!</p>