Alex Rivera | Logout

How do I set cookies from outside domains inside iframes in Safari?

Asked 2008-10-05T16:28:52.900
22

From the Apple developer faq

Safari ships with a conservative cookie policy which limits cookie writes to only the pages chosen ("navigated to") by the user.

By default Safari only allows cookies from sites you navigate to directly. (i.e. if you click on links with the url of that domainname).

This means that if you load a page from your own site with an iFrame with a page from another site, that the other site is not able to set cookies. (for instance, a ticketshop). As soon as you have visited the other domain directly, the other site is able to access and change its own cookies.

Without having access to code on the other site, how can i make the user-experience as inobtrusive as possible?

Is there a (javascript?) way to check if the other site's cookies are already set, and accordingly, show a direct link to the other site first, if needed?

Update:

The HTML5 feature 'window.postmessage' seems to be a nice solution.
There are some jQuery libraries that might help, and compatible with most recent browsers.
In essence, the iFrame document sends messages, with Json, thru the window element.

The very nice Postmessage-plugin, by daepark, which i got working.
and another jQuery postMessage, by Ben Alman i found, but haven't tested.

cookies iframe safari
Edit
Report

1 Answer

8

This is an issue known as Same Origin Policy. Essentially it is a security measure against creating security loopholes.

When you have an iframe that points to a page on your own domain, JavaScript can access both the page you're on and the page within the Iframe. This is an acceptable parent to child and child to parent relationship.

 (parent doc)        (iframe doc)
    HTML --> IFRAME <-- HTML 
      ^--------|---------^

However, once you have a file pointing to an external page, SOP comes into play and haults any information passing between the parent page and the iframe page.

 (parent doc)        (iframe doc)
    HTML --> IFRAME <-- HTML 
               X

Check out this post about iframe communication, it makes a lot of sense! Stackoverflow post

These links really help too!

1) Secure Cross-Domain Communication in the Browser
2) wiki SOP or Same Origin Policy

Good luck!

answered 2009-06-23T14:00:41.343

Your Answer