Posted by Gordon Burditt on 04/17/06 00:01

>Agreed - A cookie on two.com should not be accessible by one.com.
>
>I want the cookie on two.com to be accessible by two.com inside a frame
>originating on a page at one.com.

(1) What is the URL of the hit that sets the cookie? (might be
an image, not a frame)
(2) What is the domain argument of setcookie for the cookie?
(3) What is the URL of the page expecting to see the cookie?

Please try hard to avoid mention of what frame something is in
or what chains what.

If (1) and (2) are not related domains, it should be dropped as a
third party cookie. If (2) and (3) are unrelated, the cookie should
not be sent. There's then no way to make this work if (1) and (3)
are unrelated.

>I want the cookie on two.com to be accessible by two.com
>inside a frame
>originating on a page at one.com.

I take the above two lines to mean that (1) or (3) are on one.com
but you're trying really hard to say it's on two.com, because
that's where the frame is.


>Now, if I go into the IE privacy setting, click 'override cookie handling',
>and ensure 'always allow third party cookies' is checked the application
>will work in a frame, otherwise it will only work under IE if it is in a
>separate browser window (i.e. being the 'primary' site)

>I'm just not happy about having to give instructions to the masses telling
>them to adjust their cookie settings under IE. And as far as I'm concerned,
>site two.com using a site two.com cookie should not be an unrealistic
>thing...

You shouldn't be happy about giving such instructions. It marks you
as someone to be permanently ignored, and your site as one to be
presumed virus-ridden.

Gordon L. Burditt

[Back to original message]