Hi,
RESOLVED: This issue was resolved by changing the samesite attribute of the session cookie from strict to lax.
I am accessing the following url in an authorisation process. When the url redirects back to my site the user session cookie (from our site) is missing.
That window has been opened pro grammatically. When I manually navigate in that window from this url to our site, without clicking anything on the fitbit auth page, the site session cookie is intact.
If instead I click on one of the auth items (like activity and exercise) the redirect results in a scenario where I no longer have my site session cookie.
My site uses the prefix _SECURE- on the session cookie. Also the coolie is set to secure, http only.
example url
https://www.fitbit.com/oauth2/authorize?
response_type=code&client_id=...
&redirect_uri=https%3A%2F%2Fexample.com%2Ffitbit%2Ffitbit.php
I will try removing the -SECURE- prefix to see if this causes the issue and as a last resort I can try to append a userId to the callback url however I would then have to login the user somehow based only on this id, which creates a security issue.
