Hello 👋
I first posted this in Shopify’s App Bridge repo (Shopify/shopify-app-bridge#549), but after digging further it seems the behavior is coming from (or best handled in) kyon147/laravel-shopify, so I’m opening it here.
Summary
When installing an embedded Shopify Admin app in Safari, the install/auth flow gets stuck on a partially rendered page and never completes the redirect. Chrome works fine.
In Safari DevTools console I see an error similar to:
Unsafe JavaScript attempt to initiate navigation for frame with URL
https://admin.shopify.com/store/.../apps/...
from frame with URL
https:///authenticate?shop=...&host=...
The frame attempting navigation of the top-level window is cross-origin or untrusted and the user has never interacted with the frame.
This appears to happen when the auth “redirect” view performs something like window.open(url, "_top") (or equivalent) from inside the embedded iframe without a user gesture. Safari blocks this as unsafe cross-origin top navigation.
Screenshot (Safari console):
Context / version
My app is still on kyon147/laravel-shopify v22. Once this hit production I needed a fast mitigation, and upgrading the package wasn’t immediately feasible due to our production environment constraints (PHP 8.3.3 on the prod machine).
Workaround that fixed Safari (non-incognito)
I took the latest version of:
src/resources/views/auth/fullpage_redirect.blade.php
…and overrode it in my app (deployed to my VM). This resolved the Safari issue in normal mode (at least for basic Safari testing).
Remaining issue: Safari Incognito
After applying the workaround, I still see unexpected behavior in Safari Incognito:
Install the app
Choose a pricing plan
After that, I get redirected to my API URL (not the embedded Admin context) and end up with a blank screen.
Screenshot:
Questions / ask
Is this a known issue with the redirect approach used in v22 (and/or embedded auth flow) in Safari?
Is there an official recommendation for handling the top-level redirect in a Safari-safe way (especially when there’s no user gesture)?
For Safari Incognito specifically: could this be related to cookies/session storage restrictions, and does laravel-shopify have a recommended pattern to handle that?
Environment
laravel-shopify: v22
PHP: 8.3.3
Browser(s): Safari (normal + incognito), Chrome (works)
App type: Embedded Shopify Admin app
If helpful, I can share:
the exact overridden fullpage_redirect.blade.php diff I used
network logs / headers around the redirect in Safari Incognito
Thanks!
Hello 👋
I first posted this in Shopify’s App Bridge repo (Shopify/shopify-app-bridge#549), but after digging further it seems the behavior is coming from (or best handled in) kyon147/laravel-shopify, so I’m opening it here.
Summary
When installing an embedded Shopify Admin app in Safari, the install/auth flow gets stuck on a partially rendered page and never completes the redirect. Chrome works fine.
In Safari DevTools console I see an error similar to:
Unsafe JavaScript attempt to initiate navigation for frame with URL
https://admin.shopify.com/store/.../apps/...
from frame with URL
https:///authenticate?shop=...&host=...
The frame attempting navigation of the top-level window is cross-origin or untrusted and the user has never interacted with the frame.
This appears to happen when the auth “redirect” view performs something like window.open(url, "_top") (or equivalent) from inside the embedded iframe without a user gesture. Safari blocks this as unsafe cross-origin top navigation.
Screenshot (Safari console):
Context / version
My app is still on kyon147/laravel-shopify v22. Once this hit production I needed a fast mitigation, and upgrading the package wasn’t immediately feasible due to our production environment constraints (PHP 8.3.3 on the prod machine).
Workaround that fixed Safari (non-incognito)
I took the latest version of:
src/resources/views/auth/fullpage_redirect.blade.php
…and overrode it in my app (deployed to my VM). This resolved the Safari issue in normal mode (at least for basic Safari testing).
Remaining issue: Safari Incognito
After applying the workaround, I still see unexpected behavior in Safari Incognito:
Install the app
Choose a pricing plan
After that, I get redirected to my API URL (not the embedded Admin context) and end up with a blank screen.
Screenshot:
Questions / ask
Is this a known issue with the redirect approach used in v22 (and/or embedded auth flow) in Safari?
Is there an official recommendation for handling the top-level redirect in a Safari-safe way (especially when there’s no user gesture)?
For Safari Incognito specifically: could this be related to cookies/session storage restrictions, and does laravel-shopify have a recommended pattern to handle that?
Environment
laravel-shopify: v22
PHP: 8.3.3
Browser(s): Safari (normal + incognito), Chrome (works)
App type: Embedded Shopify Admin app
If helpful, I can share:
the exact overridden fullpage_redirect.blade.php diff I used
network logs / headers around the redirect in Safari Incognito
Thanks!