Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there any chance that Session ID's can be shared between different websites (one in other IFRAME of others) through P3P Headers?

share|improve this question

In Internet Explorer a P3P header allows 3rd party cookies within iframes. It works out of the box in all other common browsers as far as I know. However, be warned that simply copying this P3P header onto your site without understanding the legal ramifications may expose you to liability.

You cannot share one cookie between websites on different domains. But you can include url parameter in iframe to forward user information from the parent to the child sites. Of course those informations need to be signed, to prevent the user from tampering with it.

If you are asking because of Single Sign On, you may want to look at CAS or openid. CAS is useful when the accounts are managed at one central place, openid easily allows for federally distributed account management. Unlike CAS, openid does not support a signle sign out.

share|improve this answer
The 1st sentence seems to encourage people to just copy a P3P compact policy found on the net and stick it in their headers without understanding what it means or verifying that their site complies. This is bad advice! It has the potential to expose you to legal action. The content of the P3P header is a legal statement about the company's privacy policy. The FTC has been known to take legal action against companies that violate their own privacy policy. If you are in the US, don't just copy a P3P compact policy you found on the net without consulting a lawyer first. – D.W. Aug 12 '11 at 5:04

No. P3P is just a way to describe the privacy settings your browser is requesting. Unless of course you are using a P3P header for a session, but that seems like it would be impossible to get working.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.