Chrome ignores set-cookie on redirect

Author: lazaronixonCreated Feb 10, 2026Updated Feb 10, 2026

Before redirecting to the provider, Omniauth needs to set some session values that will be compared later after the callback. The problem is that Chrome sometimes ignores Set-Cookie before redirecting to cross-origin locations.

This fixed the problem for me:

oauth_submit_controller.js

javascript

import { Controller } from "@hotwired/stimulus"

export default class extends Controller {
  connect() {
    this.element.addEventListener("submit", this.submit.bind(this))
  }

  disconnect() {
    this.element.removeEventListener("submit", this.submit.bind(this))
  }

  submit(event) {
    event.preventDefault(); setTimeout(() => this.element.submit(), 300)
  }
}

html+erb

<%= button_to "Connect", "/auth/klaviyo", form: { data: { controller: "oauth-submit" } } %>

Source: omniauth/omniauth

View original on GitHub View discussion on GitHub