A Bridge the Token Never Crosses. Signing users into embedded apps without third-party cookies

Azat Davliatshin, Software Architect & Tech Lead at Quantori, author of the open-source library next-auth-bridge, which handles silent SSO for Next.js apps embedded in SharePoint, Teams, Salesforce, and Confluence. Azat has spent more than 10 years in JavaScript — from frontend to distributed systems architecture. Your Next.js app is embedded in SharePoint, Teams, or a corporate portal. The user is already signed in on the host side, but inside your iframe they're anonymous: Safari and Firefox don't share third-party cookies by default, and Chrome cuts them in incognito mode and under corporate policies. Signing in again ruins the UX. The Storage Access API shows the user a prompt. CHIPS cookies don't inherit the session on their own. And vendor SDKs lock you into someone else's identity provider. We'll break down the "bridge" pattern: a popup in the top-level context, a one-time code instead of a token, and a partitioned cookie on the other side. Azat will show the invariants without which the bridge turns into a hole, and how the same design maps onto Auth.js and Better Auth with a two-line difference.