Embedded app wont load in Safari - no Cookies

[Shaibt]

Our embedded app won't load in Safari (13.1.2):

[Error] Unrecognized Content-Security-Policy directive 'worker-src'.

[Error] Refused to load https://XXXX.myshopify.com/admin/auth/login because it does not appear in the frame-ancestors directive of the Content Security Policy.

Seems the issue is is happening while still in Shopify flow.

We're using  app-bridge-react Provider component to embed in Shopify admin.

Our embedded app doesn't use cookies so I don't think this thread is relevant to our problem  - unless I've missed something.

[instaconnect]

Hi Shaibt, did you find a solution for this?  We are experiencing the same issue.

[Shaibt]

Hi @instaconnect , unfortunately - no, haven't found a solution yet. This has worked properly before but at some point stopped to.

Think that Safari updates are outpacing some of the Shopify iframe mechanisms.

[eCreateStudio]

Hi @Shaibt, I'm also finding this issue.

It seems to be due to the Response header settings:

Content-Security-Policy: frame-ancestors 'none'

And possibly: 

X-Frame-Options: DENY

Which relate to the redirect response:

Redirect Response 303
Location: https://XXXX.myshopify.com/admin/auth/login

But I'm not sure so far where the headers for this response are set, and suspect its on the Shopify side anyway.

Pretty frustrating, my app works in Chrome and Firefox, but no joy in Safari, which is holding up my app approval.

[olivert]

Another post with similar issue

https://community.shopify.com/c/Shopify-APIs-SDKs/Unrecognized-Content-Security-Policy-directive-wor...

Had anyone ever had apps working on safari?

Seems it blocks iframes 

[phutureb]

Same here. My app does not use cookies, so solutions like this do not apply.

I am still trying to wrap my head around the issue, but what I think is happening is this:

1. When the Shopify admin page is loaded in the browser, Shopify's web server is sending along a Content-Security-Policy header containing the "worker-src" string which is unrecognized / unsupported in Safari.
   
   
2. Because Safari doesn't recognize that string, it defaults to the strictest possible interpretation, which is not to allow loading of iframes from external sources.  Thus, the iframe that loads the embedded app does not get rendered.

Does that explanation sound at all accurate?  Or am I off base?

[sillycube]

Any update in 2021?

My app also cannot work in Safari 13.1.3