Security check never finishes: Cookie partitioning

You log into Facebook, a security check appears, you follow the steps, the spinner turns… and then it just keeps turning 😐. No error. No success message. Refreshing sends you right back to the same screen. Switching tabs doesn’t help. Waiting doesn’t help. It feels like the system is almost done but never actually crosses the finish line.

When a Facebook security check never finishes, one of the most common and least obvious causes is cookie partitioning. This isn’t about wrong passwords, suspicious activity, or broken servers. It’s about how modern browsers intentionally isolate cookies in the name of privacy—and how that isolation can quietly break multi-step security flows.

Throughout this guide, I’ll reference Facebook, but the underlying mechanics apply to many sites that rely on redirects, iframes, and cross-origin verification. Once you understand what cookie partitioning does, this “endless security check” suddenly makes perfect sense.

Definition: What Cookie Partitioning Actually Is 🧩

Cookie partitioning is a browser privacy feature designed to limit cross-site tracking.

Traditionally, if a website set a cookie, that cookie could be read whenever that site’s domain appeared, even inside an iframe or redirect flow on another site. That behavior enabled tracking across the web.

Modern browsers changed this.

With cookie partitioning:

• Cookies are scoped not just to a domain, but also to the top-level site context
• The same domain can have multiple isolated cookie jars
• Cookies set in one context may be invisible in another

Apple explains this in its overview of Intelligent Tracking Prevention and partitioned cookies on WebKit, and Mozilla documents similar behavior in Firefox Total Cookie Protection. Chrome is also rolling out related changes under its Privacy Sandbox initiatives.

The key idea 👉 the browser deliberately prevents different parts of a flow from seeing the same cookies.

Why Security Checks Depend on Cookies 🍪

Facebook’s security checks are not a single page load. They are multi-step authorization flows that rely on cookies to remember progress.

A simplified version looks like this:

1. You log in
2. Facebook sets a temporary security-state cookie
3. You’re redirected to a verification step
4. That step confirms completion and updates the cookie
5. You’re redirected back to Facebook
6. Facebook reads the updated cookie and finishes login

If all steps can see the same cookie state, everything works.

If they can’t, the system never sees “verification complete.”

Where Cookie Partitioning Breaks the Flow ⚠️

With cookie partitioning enabled, this is what often happens instead:

• The login page sets a security cookie in context A
• The verification step loads in an iframe, redirect, or subdomain in context B
• Context B updates its own partitioned cookie
• You return to the main page in context A
• Context A cannot see the updated cookie from context B
• Facebook thinks verification never finished
• The security check restarts 🔁

From the server’s point of view, you never completed the check. From your point of view, you already did.

This isn’t a bug. It’s a privacy boundary doing exactly what it was designed to do.

Why There’s No Error Message 🤷‍♂️

This is the most frustrating part.

Nothing technically “fails”:

• Pages load correctly
• Verification steps respond normally
• Redirects complete

The only thing missing is shared state.

Because there’s no network error and no invalid input, the UI has nothing obvious to complain about. So you’re left staring at a spinner that’s waiting for a signal that will never arrive.

A Simple Diagram: The Invisible Wall 🧠📡

Login page (Context A)
  sets cookie A ✅
        |
        v
Verification step (Context B)
  updates cookie B ✅
        |
        v
Return to login page (Context A)
  looks for updated cookie ❌
        |
        v
"Security check still required"

Both sides did their job. They just weren’t allowed to talk to each other.

Browsers Where This Happens Most Often 🌐

You’re far more likely to see endless security checks if you’re using:

• Safari with Intelligent Tracking Prevention
• Firefox with Total Cookie Protection
• Brave with aggressive anti-tracking
• Chrome with strict privacy flags or third-party cookie blocking enabled
• Any browser in private or incognito mode

These environments prioritize privacy over cross-site continuity, which is great for tracking prevention but rough on legacy security flows.

Quick Diagnostic Table 🧪📋

How to Fix It: Practical, Low-Stress Solutions 🛠️✨

The goal is not to fight Facebook. It’s to let one consistent cookie context exist long enough for the flow to complete.

Step 1: Use a standard browser mode
Avoid private or incognito windows for security checks.

Step 2: Temporarily relax tracking protection for Facebook
In Safari, Firefox, Brave, or Chrome, allow cookies and disable strict tracking protection for Facebook only. You can re-enable it afterward.

Step 3: Avoid embedded or framed logins
Don’t log in from links opened inside email apps, messengers, or other in-app browsers. Open Facebook directly in the browser.

Step 4: Stick to one tab and one window
Multiple tabs can create multiple top-level contexts, increasing partitioning issues.

Step 5: Try a different browser for the check
If your daily browser is privacy-hardened, use a vanilla browser just to complete the security check.

Step 6: Let the flow finish without refreshing
Refreshing mid-check can reset context and restart the loop.

In many cases, once cookie partitioning is relaxed and the flow completes once, future logins stop triggering the endless check.

Real-World Examples 🌍

Example 1: A user on Safari completes the security check repeatedly, but it never finishes. Opening Facebook in Chrome allows the check to complete instantly.

Example 2: A Firefox user with Total Cookie Protection enabled hits a loop. Temporarily disabling strict protection for Facebook resolves it.

Example 3: A user logs in via a link inside a mail app. The embedded browser isolates cookies. Opening Facebook directly in the system browser fixes the issue.

A Short Anecdote 📖🙂

I once heard someone say, “It’s like Facebook has Alzheimer’s.” In reality, Facebook remembered everything. The browser just refused to let different steps share that memory. The moment they switched from a hardened browser profile to a normal one, the security check completed in seconds. Same account. Same password. Different cookie rules.

Frequently Asked Questions (10 Niche FAQs) ❓🧠

1) Is this a Facebook bug?
No. It’s a browser privacy feature interacting badly with a multi-step flow.

2) Does clearing cookies help?
Only temporarily. Partitioning will still apply afterward.

3) Why does it work on mobile apps?
Apps don’t use browser cookie partitioning.

4) Is this related to third-party cookies?
Yes. Many security flows rely on behavior now treated like third-party access.

5) Can VPNs cause this?
Not directly. This is storage, not IP-based.

6) Does two-factor authentication matter here?
It can be part of the same flow, but the root issue is cookie visibility.

7) Why does refreshing make it worse?
Refreshes can reset or re-partition context mid-flow.

8) Can Facebook fix this?
They are gradually updating flows, but browser privacy changes move faster.

9) Is this permanent?
No. It depends on browser settings and context.

10) Should I lower my privacy settings permanently?
No. Temporary exceptions are usually enough.

People Also Ask 🧠💡

Why does Facebook security check keep looping?
Because the browser blocks shared cookie state between steps.

Is cookie partitioning good or bad?
Good for privacy, tricky for legacy security flows.

Why does switching browsers work?
Different browsers enforce partitioning differently.

Can this affect other sites too?
Yes. Any site using multi-step verification can be affected.

Conclusion: The Check Finished, the Browser Forgot 🔐

When a Facebook security check never finishes, the system usually isn’t stuck. It’s waiting for confirmation stored in a cookie it’s no longer allowed to read. Cookie partitioning creates invisible walls, and the security flow keeps bouncing between them.

Once you understand that this is a state-sharing problem, not a trust problem, the fix becomes calm and practical. Use a consistent browser context, relax tracking protection briefly, let the flow complete once, and move on.

Nothing was wrong with your account. The browser just refused to let the pieces talk to each other 🍪🙂.