Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Cookies inside script-tag include on cross domains

So I have this page on one domain that has a script-tag pointing on another domain and everytime I refresh the page, a new session_id is generated. This only happens on IE, all other browsers seems to work.

Here is an exemple with code (JS and PHP)

http://domain1.com/index.php :

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>Untitled Document</title>
<script src="http://domain2.com/index.php"></script>
</head>
<body>
</body>
</html>

And on http://domain2.com/index.php :

<?php
    session_start();
    header("content-type: application/x-javascript");
    echo "alert('".session_id()."');";
?>

Open Chrome or Firefox in domain1.com/index.php and you should see an alert box with a session id. Everytime you refresh you always have the same session id. In IE (I tried with 7, 8 and 9), the session id is always different. The cookies doesn't seem to be saved properly.

Thanks for any help.

like image 314
Frank Avatar asked Oct 05 '11 22:10

Frank


1 Answers

For documentation purposes, here's the solution I found:

I created a p3p file with the IBM P3P Policy editor (the p3p and CP file) Uploaded the files in the folder /w3c And added the following header in the file on the domain2.com P3P: CP="content from the CP generated file"

like image 150
Frank Avatar answered Oct 12 '22 13:10

Frank