Posted by Bruno on 04/17/06 00:16

Hi Gordon, and thanks for all the effort you are putting into this - Much
appreciated.

From your questions below (1) is the same as (2) which is the same as (3) .
(except that I have thus far left the domain specification at null when
setting the cookie - this should default it to (1) I assume).

It works fine when in it's own browser window, but not when contained in a
frame from a different site.



"Gordon Burditt" <gordonb.89ee7@burditt.org> wrote in message
news:1245c5cb7h4bdf9@corp.supernews.com...
> >Agreed - A cookie on two.com should not be accessible by one.com.
>>
>>I want the cookie on two.com to be accessible by two.com inside a frame
>>originating on a page at one.com.
>
> (1) What is the URL of the hit that sets the cookie? (might be
> an image, not a frame)
> (2) What is the domain argument of setcookie for the cookie?
> (3) What is the URL of the page expecting to see the cookie?
>
> Please try hard to avoid mention of what frame something is in
> or what chains what.
>
> If (1) and (2) are not related domains, it should be dropped as a
> third party cookie. If (2) and (3) are unrelated, the cookie should
> not be sent. There's then no way to make this work if (1) and (3)
> are unrelated.
>
>>I want the cookie on two.com to be accessible by two.com
>>inside a frame
>>originating on a page at one.com.
>
> I take the above two lines to mean that (1) or (3) are on one.com
> but you're trying really hard to say it's on two.com, because
> that's where the frame is.
>
>
>>Now, if I go into the IE privacy setting, click 'override cookie
>>handling',
>>and ensure 'always allow third party cookies' is checked the application
>>will work in a frame, otherwise it will only work under IE if it is in a
>>separate browser window (i.e. being the 'primary' site)
>
>>I'm just not happy about having to give instructions to the masses telling
>>them to adjust their cookie settings under IE. And as far as I'm
>>concerned,
>>site two.com using a site two.com cookie should not be an unrealistic
>>thing...
>
> You shouldn't be happy about giving such instructions. It marks you
> as someone to be permanently ignored, and your site as one to be
> presumed virus-ridden.
>
> Gordon L. Burditt

[Back to original message]