2

When there's a Youtube video embedded on a site that I visit while I am logged in Youtube beforehand,how does the embedded video know that it's me so I can add it to my Watch Later list?

I think the process is like this:

The site that embeds the video gets sent the Youtube cookies.

  1. What kind of cookies is that? my session authenticated cookies? is there a csrf token also sent? I think that the site although that it receives the cookies it cannot read/access them.

  2. Does Youtube also receive and read those cookies because the video is inside an iframe? so that is why it can identify me? If the video wasn't included in an iframe but the site would just link to a Youtube video/image file in plain tag/href, would Youtube be still able to receive the cookies but not actually read them? I mean what does the iframe do differently.

  3. Doesn't Youtube through the embedded video set third party cookies too?Does it mean that it can track me when visiting other sites that have embedded videos/elements from YouTube?

1
  • You tagged this with iframe and that is the most relevant bit. Look up how cookies are handled in iframes.
    – schroeder
    Dec 15, 2022 at 12:25

1 Answer 1

2

Embedded Youtube videos are embedded through an iframe. An iframe is in many ways like a separate browser tab. If you open YouTube in a new tab (for example by clicking a link), of course YouTube will get access to the cookies set for the YouTube domain. But when you open a site that has a YouTube iframe, then that iframe will load a page from YouTube, and in that context the YouTube page will have access to the YouTube cookies.

The main site that contains the iframe doesn't get access to those cookies – only the page within the iframe does.

Third-party cookies are not relevant in this context. When third party cookies are enabled, a page on one domain can set cookies for a completely different domain. Third-party cookies are mostly used for tracking purposes, for example in order to allow a random fashion blog example.com to retrieve and update advertising tracking information for the user via a cookie set for a domain some-tracking-network.example. Third-party cookies could also enable a logged-in experience for an embedded Youtube video when no iframes are used.

Some browsers provide first-party isolation / state isolation, so that iframes do not get access to the cookies of their site. Previously, I said that cookies are associated with a domain, e.g. youtube.com. More precisely, they are stored under some key, typically the domain name. But with state isolation, the key for iframes contains both the domain name of the embedding site and the embedded site.

For example, we might watch a video

  • on youtube.com directly, or
  • embedded as an iframe on foo.example.

There are different potential contexts here:

  • the youtube.com site
  • the foo.example site
  • the youtube.com iframe embedded in the foo.example site

As discussed above, normally the YouTube iframe and the YouTube site have the same cookie context. With state partitioning, all those three contexts have different cookie contexts and can't share data via that mechanism – the embedded YouTube video would appear as for a logged-out user.

Sometimes you see Youtube videos embedded via the youtube-nocookie.com domain. This serves the same video, but because the domain name isn't youtube.com the embedded video will not have access to your youtube.com cookies.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .