# Troubleshoot trusted authentication

> For the complete documentation index, see [llms.txt](https://developers.thoughtspot.com/docs/llms.txt)

Source: https://developers.thoughtspot.com/docs/trusted-auth-troubleshoot

# Troubleshoot trusted authentication

## Initial steps

CORS and CSP [must be configured correctly]({{navprefix}}/{{security-settings}}) for any embedding and REST API commands to work from the browser.

## Third-party cookie issues

When implementing trusted authentication with session cookies, check if your browser allows third-party cookies.

Chrome now blocks third-party cookies in Incognito mode by default, while Safari blocks them by default even in standard mode.

If your Web browser rejects third-party cookies, the embedded content will be blocked.

To workaround this issue, you can either use cookieless authentication (`AuthType.TrustedAuthTokenCookieless`) in the SDK or [customize the ThoughtSpot instance domain]({{navprefix}}/{{custom-domain-configuration}}) to match the top-level domain of your embedding web app.

## Tester HTML page

The token\_auth directory contains a [trusted\_auth\_tester.html](https://github.com/thoughtspot/ts_everywhere_resources/blob/master/examples/token_auth/trusted_auth_tester.html) page to help verify each step of the trusted authentication process.

## Use browser developer tools

Using the **Network** and **JavaScript Console** tabs of your browser’s Developer Tools, you should see the following steps triggered by the `init()` function when using cookie-based trusted authentication:

1.  Make a `GET` request to the `/session/info` API endpoint.
    
2.  If `/session/info` returns as a 401 error (red), you will see a `GET` request to the URL specified in the `authEndpoint` property or the URL defined in the callback function referred to be `authEndpoint` (GET or POST).
    
3.  Response from the URL above should return 200 with a **login token**.
    
4.  When the **login token** is received, the `init()` function makes a `POST` request to the `/session/login/token` REST API v1 endpoint.
    
5.  The first response to `/session/login/token` will be an HTTP 204. It may show "OPTIONS" rather than "POST"
    
6.  Immediately following should be an HTTP 302 (Redirect) response to the `POST` request. There should be several **set-cookie** headers in the response, particularly a **JSESSIONID=**.
    

If the **set-cookie** response does not come through and actually sets the ThoughtSpot cookies in the browser, sign-in will not complete.

With cookie-less trusted authentication, you will see that every request to the ThoughtSpot instance has a request header of the form, including the retrieved token from the **token request service**:

\`authorization: Bearer YnJ5YW50Lmhvd2VsbDpKSE5vYVhKdk1TUlRTRUV0TWpVMkpEVXdNREF3TUNRNWRGcDZVREY2VUcxMmIyVXZUalEyT1ZaMWIxaEJQVDBrYTFSeVRIRmtZV1k0UjJWUldHTndPVVZIWTJsb1RVVTFVR1lyWWsxU1NtMTVVSEo1TTJkS2Ftc3laejA=\`