Mixing
Is there a way to make my site claim third-party cookies as first-party cookies?
My Angular 6 site uses an iframe to display another website's resources. The source of the iframe is the url to the resource I want, and the src gets changed dynamically if the users click on a different button. The first time the third-party site is hit using the iframe a basic authenticating process occurs
I ask for a resource
I am redirected to their authorization URL
They ask for authorization
I provide them my token
They give me a token as proof of authenticating and redirect back to resource
This method works great in Chrome, and I can view the third-party page's resources just fine. However in IE it does not work until I reduce the default internet security settings. What I think happens is the default settings are blocking third-party cookies, so the third party site can never send me proof that I am a valid user of their resources and thus they never show.
Is there a way for my domain to claim cookies from their domain as first-party cookies somehow? This way I can get around the IE default settings shutting me down.
bump
angular authentication cookies iframe cross-domain edited Jan 4 at 0:49
sideshowbarker
33.5k157997
asked Dec 31 '18 at 14:24
skyleguyskyleguy
1241315
add a comment |
My Angular 6 site uses an iframe to display another website's resources. The source of the iframe is the url to the resource I want, and the src gets changed dynamically if the users click on a different button. The first time the third-party site is hit using the iframe a basic authenticating process occurs
I ask for a resource
I am redirected to their authorization URL
They ask for authorization
I provide them my token
They give me a token as proof of authenticating and redirect back to resource
This method works great in Chrome, and I can view the third-party page's resources just fine. However in IE it does not work until I reduce the default internet security settings. What I think happens is the default settings are blocking third-party cookies, so the third party site can never send me proof that I am a valid user of their resources and thus they never show.
Is there a way for my domain to claim cookies from their domain as first-party cookies somehow? This way I can get around the IE default settings shutting me down.
bump
angular authentication cookies iframe cross-domain edited Jan 4 at 0:49
sideshowbarker
33.5k157997
asked Dec 31 '18 at 14:24
skyleguyskyleguy
1241315
add a comment |
My Angular 6 site uses an iframe to display another website's resources. The source of the iframe is the url to the resource I want, and the src gets changed dynamically if the users click on a different button. The first time the third-party site is hit using the iframe a basic authenticating process occurs
I ask for a resource
I am redirected to their authorization URL
They ask for authorization
I provide them my token
They give me a token as proof of authenticating and redirect back to resource
This method works great in Chrome, and I can view the third-party page's resources just fine. However in IE it does not work until I reduce the default internet security settings. What I think happens is the default settings are blocking third-party cookies, so the third party site can never send me proof that I am a valid user of their resources and thus they never show.
Is there a way for my domain to claim cookies from their domain as first-party cookies somehow? This way I can get around the IE default settings shutting me down.
bump
angular authentication cookies iframe cross-domain edited Jan 4 at 0:49
sideshowbarker
33.5k157997
asked Dec 31 '18 at 14:24
skyleguyskyleguy
1241315
My Angular 6 site uses an iframe to display another website's resources. The source of the iframe is the url to the resource I want, and the src gets changed dynamically if the users click on a different button. The first time the third-party site is hit using the iframe a basic authenticating process occurs
I ask for a resource
I am redirected to their authorization URL
They ask for authorization
I provide them my token
They give me a token as proof of authenticating and redirect back to resource
This method works great in Chrome, and I can view the third-party page's resources just fine. However in IE it does not work until I reduce the default internet security settings. What I think happens is the default settings are blocking third-party cookies, so the third party site can never send me proof that I am a valid user of their resources and thus they never show.
Is there a way for my domain to claim cookies from their domain as first-party cookies somehow? This way I can get around the IE default settings shutting me down.
bump
angular authentication cookies iframe cross-domain angular authentication cookies iframe cross-domain edited Jan 4 at 0:49
sideshowbarker
33.5k157997
asked Dec 31 '18 at 14:24
skyleguyskyleguy
1241315
edited Jan 4 at 0:49
sideshowbarker
33.5k157997
asked Dec 31 '18 at 14:24
skyleguyskyleguy
1241315
edited Jan 4 at 0:49
sideshowbarker
33.5k157997
edited Jan 4 at 0:49
sideshowbarker
33.5k157997
edited Jan 4 at 0:49
sideshowbarker
33.5k157997
33.5k157997
asked Dec 31 '18 at 14:24
skyleguyskyleguy
1241315
asked Dec 31 '18 at 14:24
skyleguyskyleguy
1241315
asked Dec 31 '18 at 14:24
skyleguyskyleguy
1241315
1241315
add a comment |
add a comment |
1 Answer
1
active
oldest
votes
So it turns out Windows 7 with IE 11 still requires something called P3P for third-party cookies to not be blocked.
Basically how third-party cookies used to be handled was the issuer of the cookie had to have a privacy policy created and hosted somewhere, like 'example.com/policy.html'. This policy is a disclaimer telling users how their data is being used. The issuer had to send a header with that link as its value to allow browsers to accept their cookies. The browser 'trusted' the cookie because it had a policy the user can look up to see how their data is being used. From some other stack overflow questions I found that this P3P business is extremely outdated and not many entities care much about it. We also don't even really need to worry about the policy at the url actually existing anymore.
I had to ask the external site to add the following header to all responses that contained a cookie:
P3P: CP="Test"
Where "Test" can be literally anything else and it worked!
Resources:
Cookie blocked/not saved in IFRAME in Internet Explorer
https://security.stackexchange.com/questions/153084/is-it-ok-to-turn-off-p3p-in-ie11-on-windows-7
answered Jan 2 at 20:24
skyleguyskyleguy
1241315
add a comment |
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53988507%2fis-there-a-way-to-make-my-site-claim-third-party-cookies-as-first-party-cookies%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
So it turns out Windows 7 with IE 11 still requires something called P3P for third-party cookies to not be blocked.
Basically how third-party cookies used to be handled was the issuer of the cookie had to have a privacy policy created and hosted somewhere, like 'example.com/policy.html'. This policy is a disclaimer telling users how their data is being used. The issuer had to send a header with that link as its value to allow browsers to accept their cookies. The browser 'trusted' the cookie because it had a policy the user can look up to see how their data is being used. From some other stack overflow questions I found that this P3P business is extremely outdated and not many entities care much about it. We also don't even really need to worry about the policy at the url actually existing anymore.
I had to ask the external site to add the following header to all responses that contained a cookie:
P3P: CP="Test"
Where "Test" can be literally anything else and it worked!
Resources:
Cookie blocked/not saved in IFRAME in Internet Explorer
https://security.stackexchange.com/questions/153084/is-it-ok-to-turn-off-p3p-in-ie11-on-windows-7
answered Jan 2 at 20:24
skyleguyskyleguy
1241315
add a comment |
So it turns out Windows 7 with IE 11 still requires something called P3P for third-party cookies to not be blocked.
Basically how third-party cookies used to be handled was the issuer of the cookie had to have a privacy policy created and hosted somewhere, like 'example.com/policy.html'. This policy is a disclaimer telling users how their data is being used. The issuer had to send a header with that link as its value to allow browsers to accept their cookies. The browser 'trusted' the cookie because it had a policy the user can look up to see how their data is being used. From some other stack overflow questions I found that this P3P business is extremely outdated and not many entities care much about it. We also don't even really need to worry about the policy at the url actually existing anymore.
I had to ask the external site to add the following header to all responses that contained a cookie:
P3P: CP="Test"
Where "Test" can be literally anything else and it worked!
Resources:
Cookie blocked/not saved in IFRAME in Internet Explorer
https://security.stackexchange.com/questions/153084/is-it-ok-to-turn-off-p3p-in-ie11-on-windows-7
answered Jan 2 at 20:24
skyleguyskyleguy
1241315
add a comment |
So it turns out Windows 7 with IE 11 still requires something called P3P for third-party cookies to not be blocked.
Basically how third-party cookies used to be handled was the issuer of the cookie had to have a privacy policy created and hosted somewhere, like 'example.com/policy.html'. This policy is a disclaimer telling users how their data is being used. The issuer had to send a header with that link as its value to allow browsers to accept their cookies. The browser 'trusted' the cookie because it had a policy the user can look up to see how their data is being used. From some other stack overflow questions I found that this P3P business is extremely outdated and not many entities care much about it. We also don't even really need to worry about the policy at the url actually existing anymore.
I had to ask the external site to add the following header to all responses that contained a cookie:
P3P: CP="Test"
Where "Test" can be literally anything else and it worked!
Resources:
Cookie blocked/not saved in IFRAME in Internet Explorer
https://security.stackexchange.com/questions/153084/is-it-ok-to-turn-off-p3p-in-ie11-on-windows-7
answered Jan 2 at 20:24
skyleguyskyleguy
1241315
So it turns out Windows 7 with IE 11 still requires something called P3P for third-party cookies to not be blocked.
Basically how third-party cookies used to be handled was the issuer of the cookie had to have a privacy policy created and hosted somewhere, like 'example.com/policy.html'. This policy is a disclaimer telling users how their data is being used. The issuer had to send a header with that link as its value to allow browsers to accept their cookies. The browser 'trusted' the cookie because it had a policy the user can look up to see how their data is being used. From some other stack overflow questions I found that this P3P business is extremely outdated and not many entities care much about it. We also don't even really need to worry about the policy at the url actually existing anymore.
I had to ask the external site to add the following header to all responses that contained a cookie:
P3P: CP="Test"
Where "Test" can be literally anything else and it worked!
Resources:
Cookie blocked/not saved in IFRAME in Internet Explorer
https://security.stackexchange.com/questions/153084/is-it-ok-to-turn-off-p3p-in-ie11-on-windows-7
answered Jan 2 at 20:24
skyleguyskyleguy
1241315
answered Jan 2 at 20:24
skyleguyskyleguy
1241315
answered Jan 2 at 20:24
skyleguyskyleguy
1241315
answered Jan 2 at 20:24
skyleguyskyleguy
1241315
1241315
add a comment |
add a comment |
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53988507%2fis-there-a-way-to-make-my-site-claim-third-party-cookies-as-first-party-cookies%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
