ITP blocks Auth0 with auth0-react

Question

The Safari ITP blocks my Auth0 authentication in my React App, and it seems that Firefox is doing something similar.

I tried the various solutions such as using useRefreshTokens="true" in my <Auth0Provider> but I had to default to using localStorage (I am aware of the implications, but in a case of a XSS attack, using httpOnly token won't save you if the attacker wants to call your API anyway).

Is using the option useRefreshTokens and modifying the Application's parameter on the website enough to use it, or is it necessary to call a function from the library?

The documentation and forums seem to be extremely lacking clarity in the way it works.

Answer 1

I've had so many drawbacks using Auth-0 and auth0-react that I'm probably gonna ditch it and do it myself.