Google Workspace SSO-enabled Org Cross-Domain Cookies Error

Question

My Salesforce org has SSO implemented using SAML 2.0 with Google Accounts / Workspace as the Identity Provider (IdP).

Everything worked well, until I recently decided to move from Chrome to Brave as my default browser. In Brave (and Safari), I cannot access the Setup pages from the Lightning Experience (everything works in Classic Mode). The settings side bar loads just fine, but the actual settings pages don't load at all (the iframes don't load). The error that I get in the console is: Refused to display 'https://accounts.google.com/' in a frame because it set 'X-Frame-Options' to 'sameorigin'.

After some digging I found out that there are clickjacking settings in Salesforce (and the browser itself) that might be causing this error. I have added https://accounts.google.com both to the Trusted Domains for Inline Frames and the CSP Trusted Sites, to no avail. What really doesn't make sense to me is that it works just fine in Chrome but not in Brave and Safari.

I don't want my users to face this issue, or force them to use a browser (heck, I wouldn't do that myself). Is there a way to permanently trust https://accounts.google.com so that it works in Salesforce's iframes? Do I have to disable the Enable clickjack protection for Setup pages setting from Session Settings (I'll have to contact Salesforce to do that of course)? I would really appreciate if someone could help me out with this issue. TIA. :)

Answer 1

After some more digging, it turns out this is an old issue with Salesforce Lightning Experience on browsers that offer strict security measures, this includes Brave and Safari (both the browsers where I faced this issue).

Salesforce is actively working on updating these pages so that they display correctly. In the meantime, a message was added to the affected Setup pages: “We can’t display this page because your browser blocks cross-domain cookies, but you can view this page in Salesforce Classic.” Click the link in the message to reload the page in Classic. (Source from 2020)

For now, I solved my issue by always allowing cookies from Salesforce.com and Force.com. I did this by adding [*.]salesforce.com and [*.]force.com to my Brave browser cookie settings (specifically Sites that can always use cookies). This conversation from a random Mozilla Google Group helped me.

P.S. I'm not going to mark this as the answer because I'm still interested in learning any better solutions for this issue. Seems like a long standing issue for Salesforce.