beno
I just spent the better part of the day figuring out why my phoenix app could authenticate through Auth0 flawlessly via Chrome and gives a fatal error (invalid_token) via Safari.
Long story short, it turns out the ‘put_secure_browser_headers’ put so many blocks in place (and Safari supports these more than Chrome) that this was a server based problem masquerading as a client issue. I am still figuring out what valid values response headers are, but I don’t think security defaults should get in the way of functionality like that.
I would suggest to make these thing more explicit and/or optional. This has been quite a frustrating day.
Where Next?
Trending in Discussions
Other Trending Topics
Latest Phoenix Threads
Latest on Elixir Forum
Sponsor Spotlight
Deploy Phoenix to your own VPS with PaaS ease: push-to-deploy, zero downtime, auto SSL, managed Postgres. 14-day free trial at potions.io
Categories:
Sub Categories:
Forums
Popular Tags
- #ecto
- #liveview
- #troubleshooting
- #learning-elixir
- #deployment
- #library
- #erlang
- #testing
- #genserver
- #mix
- #absinthe
- #remote-other
- #otp
- #plug
- #how-to-question
- #macros
- #postgres
- #elixirconf
- #channels
- #exunit
- #discussion
- #code-sync
- #javascript
- #podcasts
- #onsite
- #dialyzer
- #docker
- #authentication
- #umbrella
- #full-time-contract
- #podcasts-by-brainlid
- #ecto-query
- #blog-post
- #elixir-ls
- #ai
- #elixirconf-us
- #phoenix_html
- #iex
- #graphql
- #genstage
- #websockets
- #supervisor
- #advent-of-code
- #distillery
- #processes
- #api
- #forms
- #hex
- #security
- #metaprogramming
Our Sponsors
Build Elixir applications with speed and confidence.
Supporting innovation across the BEAM ecosystem.
We build reliable cloud platforms for business-critical systems.
Catch errors, track performance, monitor hosts and more.
Elixir, Erlang & BEAM conferences from Code Sync - join us in 2026!
Practical resources that improve the lives of professional developers.
Master modern tools, write cleaner code, and tackle real-world challenges.
Bringing learning, work and compliance together since 1987.
The team behind Membrane, Popcorn, LiveDebugger. Available for hire.
Courses that'll move you from confusion to "Aha, now I get it!"
Showing Posts 1 to 1- Show Best Posts
- Show All (oldest first)
- Show All (newest first)
beno
Well it turns out I was premature in my conclusions, even after removing all the security headers the Safari errors remain. Even the people at Auth0 are stumped now, it looks like an issue that arises solely with Phoenix & Safari. Should anyone care, here’s the thread:
https://github.com/auth0/auth0.js/issues/894
I hope someone recognises some of it, it has completely worn me out.