A customer signs in successfully in a provider tab but repeatedly sees the login screen inside a business website. Commission a context-by-context diagnosis before accepting instructions to disable browser privacy controls or weaken cookies.
Primary evidence and claim boundaries
MDN explains that SameSite controls cross-site cookie sending and that SameSite=None requires Secure. Other browser policies can still restrict third-party cookies. Primary reference · Read 17 October 2026.
Filled acceptance example
Synthetic teaching scenario, not a client case, provider integration test or business result. Scroll the example table on narrow screens.
| Synthetic context | Observed evidence | Next decision |
|---|---|---|
| Provider top-level HTTPS tab | Session cookie sent; login works | Record working reference context |
| Cross-site iframe; cookie Lax | Cookie not attached in this subresource context | Candidate SameSite/context cause; not proven yet |
| Iframe; None+Secure | Browser blocks third-party storage | Attribute change alone insufficient |
| Approved separate-tab fallback | User logs in without privacy bypass | Assess supported vendor flow |
Practical handover procedure
- Record top-level site, embedded origin, HTTPS, cookie attributes and browser version/settings. Inspect only authorised redacted test sessions; never copy session values into a support ticket.
- Compare direct and embedded navigation with the same test account. Distinguish cookie rejection from authentication failure, iframe sandbox restrictions and vendor embedding support.
- Ask the vendor for its supported sign-in and fallback design. Security/privacy staff approve any policy proposal separately; keep a user-accessible route when embedding is unavailable.
Interpret the outcome
The matrix avoids a one-line “set SameSite=None” fix. It preserves both the symptom and the missing evidence. A working standalone login narrows the investigation but does not prove which browser control caused the failure.
Acceptance decision
Require reproduced context differences, a vendor-supported solution and a working fallback on the supported browser set. Do not accept disabling third-party protections as the customer journey.
Limits and unverified work
No login, cookie mutation or security change was executed. This does not prescribe a universal authentication architecture or a legal consent basis.
Download the filled bilingual acceptance record — Contains these inputs, steps, expectations and limits. This is a teaching record, not an executable integration.