I'm researching the authentication flow in the case that 3rd party cookies are used to authenticate to a website, and are blocked by policy, proxy, or browser settings.

It's clear that CORS and various plugins would fail in the event these are disabled.

I've seen developers do some "creative" things to workaround this limitation...


  1. What are the workarounds and threats each workaround exposes?

  2. What is the most reliable approach? (how does *.StackExchange do it?)


  • IFrames + blocked 3rd party cookies
  • Using stealth cookies (e.g. Evercookie / ETags / etc)
  • Referer headers
  • SSL / HTTP only cookies
  • A backchannel conversation between the two hosts. (trusted)
  • Why on earth would you use 3rd party cookies in authentication? I always have them blocked to help reduce the level of tracking and crappy madvertising. – Julian Knight Jan 22 '17 at 23:27
  • 1
    @JulianKnight Authentication via an IDP, Security.StackExchange.com, and StackOverflow.com. Additional example: live.com, outlook.com, onedrive.com. Google, IBM, and all the big guys do the same – Christopher Jan 22 '17 at 23:45
  • 1
    Urm, I think we have some wires crossed here. Authentication might be provided by a different domain - e.g. MS uses login.microsoft.com - but that isn't reliant on 3rd party cookies. Delegated trust is provided via things like OAuth & JWT. – Julian Knight Jan 22 '17 at 23:53
  • 1
    @JulianKnight If that is the case, then I'm just looking for documentation and workarounds... Disquss, FB, and many others (outside of advertising) rely on 3rd party cookies. – Christopher Jan 22 '17 at 23:55
  • Just do some research on OAuth & JWT. All the answers are there. But certainly those services don't "rely" on 3rd party cookies otherwise disabling them would disable large parts of the Internet - which certainly doesn't happen. – Julian Knight Jan 23 '17 at 0:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.