[Safari] Cookies for iFrame domain not set

-

The Problem

Apple's Safari web browser is configured to block third-party cookies by default, unless the user has had prior interactions with the third-party domain:
http://webpolicy.org/2012/02/17/safari-trackers/


The Solution

The idea is simple, just make sure the user visits the iframe domain (in this example, B.com) at least once.

One way is to run a popup that visits B.com (and set the P3P header), then close the popup.

On the parent window:
var win = window.open('http://B.com/startsession.php', '_blank', 'height=200,width=150');
setTimeout(function() {
win.close(); // close it after 1 second :)
}, 1000);

Then in the startsession.php, just set the header will do
<?php
header('P3P: CP="IDC DSP COR CURa ADMa OUR IND PHY ONL COM STA"');
session_start();

Done.


References:
http://webpolicy.org/2012/02/17/safari-trackers/
http://anantgarg.com/2010/02/18/cross-domain-cookies-in-safari/
http://anantgarg.com/2012/02/18/busting-the-cookies-and-privacy-myth/

Comments

Post a Comment

Popular posts from this blog

[Azure Websites PHP] Cross Domain request results in blank response page after Preflight HTTP OPTIONS

-
Image
THE PROBLEM I've deployed a REST API application ( CodeIgniter with Phil Sturgeon's Rest-Server library ) on Azure Websites. Although I've set the Access-Control-* header in my PHP application: header('Access-Control-Allow-Credentials: true'); header('Access-Control-Allow-Origin: *'); header('Access-Control-Allow-Methods: GET, POST, DELETE, OPTIONS'); header('Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept'); (If you need a working test file, here's the gist for the test file) But Azure Websites server doesn't return the headers in response. And thus all requests to the server failed with the error message: Origin http://example.azurewebsites.net is not allowed by Access-Control-Allow-Origin.   In order to make sure there's no problem with my application, I've deployed the same code to Appfog.com . And as expected, the application works just fine. The same application d...
Read more

[Magento] Create Contact Form with Dynamic Recipient

-
There are many ways of creating contact forms to email to multiple recipient. I'm going to describe a way that uses Javascript a the frontend to change the target recipient. Advantage of this method: Easy to add in new emails in the future. Disadvantage of this method: For those who are particularly concern email privacy, you might not want to use this method. You can modify the email checking to the backend (controller) instead. Okay enough talking, lets get started. Step 1: Set up HTML form fields I'm going to use an example of drop down select to change the email. Of course, this is fairly easy to modify with other forms as well. Open up app/design/frontend/default/<theme>/template/contacts/contacts.phtml Insert the following snippets anywhere between the <form>...</form> tag. <select name="interest" id="interest" title="<?php echo Mage::helper('contacts')->__('Please select department t...
Read more