1

I'm trying unsuccessfully to set a cookie in an iframe cross-domain. I've found elsewhere (https://stackoverflow.com/questions/2117248/setting-cookie-in-iframe-different-domain, https://stackoverflow.com/questions/4701922/how-does-facebook-set-cross-domain-cookies-for-iframes-on-canvas-pages) that it should be possible with some caveats.

My scenario is the following: I have a page served from https://a.com/sample which contains an iFrame served from https://b.com/sample. The b.com/sample page set a cookie for b.com domain (samesite=none, secure, httponly).

If I load the original b.com page https://b.com/sample in the browser window I correctly see the cookie set and it is available for other b.com pages (https://b.com/some-other-page); If I load the https://a.com/sample page I see the cookie set inside the page, but if I switch to other b.com domain pages the cookie is not available.

I suppose this is due to cross-domain security checks (I tried on Safari and Firefox), is there any way to make this work? I see the same behavior if I switch to localStorage

1

1 Answer 1

0

There are two reliable ways without any tricks.

  1. Send data from one domain to another via an explicit request. In your case, b.com can send a request to a.com, and a.com can do whatever it needs, e.g. set these data to cookies for a.com.

  2. Send needed data via Window.postMessage(). Using this method, the IFrame of b.com can send any data to the window of a.com. The code in the a.com windows can do whatever needed, e.g. set these data to cookies.

3
  • see my answer with firefox screenshots
    – Los Sol
    Mar 13, 2023 at 9:29
  • This has nothing to do with 3rd party cookies. When the windows a.com receives a messages, it sets cookie for its own domain, a.com. If settings for 3rd party cookies affect that, it means, you are doing something wrong.
    – mentallurg
    Mar 13, 2023 at 10:04
  • I've found that the behavior is due to dynamic state partitioning
    – Los Sol
    Mar 13, 2023 at 22:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .