I'm researching the authentication flow in the case that 3rd party cookies are used to authenticate to a website, and are blocked by policy, proxy, or browser settings.
It's clear that CORS and various plugins would fail in the event these are disabled.
I've seen developers do some "creative" things to workaround this limitation...
What are the workarounds and threats each workaround exposes?
What is the most reliable approach? (how does *.StackExchange do it?)
- IFrames + blocked 3rd party cookies
- Using stealth cookies (e.g. Evercookie / ETags / etc)
- Referer headers
- SSL / HTTP only cookies
- A backchannel conversation between the two hosts. (trusted)