---
title: Cross-origin customer auth for headless integrations
type: changelog
date: 2026-09-10
changelog:
  category: SDK
---

`storefront.auth.*` (login, `isLoggedIn()`, the Customer Console) now works from a headless integration hosted on its own domain, not just one proxied under the shop's — the session cookie is now `SameSite=None; Secure` in production. This closed two CORS/CSRF gaps that relaxing `SameSite` would otherwise have reopened; see [Authentication](/frontend/sdk/auth) and this repo's `CLAUDE.md` for the full writeup.