Menu
We're running a service on our-site.com. Our customers can either use the service "stand alone" by simply linking from their-site.com to our-site.com/customer-service or by embedding our service via iFrame into their-site.com. Imagine visiting GMaps directly vs. seeing it embedded in an IFrame.
Beginning with Chrome 80 (i guess) our Google Analytics stopped working when the service runs inside the iFrame. Chrome is giving me this (quite clear) message:
A cookie associated with a cross-site resource at http://our-site.com/ was set without the
SameSiteattribute. It has been blocked, as Chrome now only delivers cookies with cross-site requests if they are set withSameSite=NoneandSecure. You can review cookies in developer tools under Application>Storage>Cookies and see more details at https://www.chromestatus.com/feature/5088147346030592 and https://www.chromestatus.com/feature/5633521622188032.
Also I don't see anything in the GA realtime overview if I visit their-site.com with our our-site.com/customer-service embedded in the iFrame.
If I manually disable the 2 features same-site-by-default-cookies & cookies-without-same-site-must-be-secure in chrome://flags and visit their-site.com with our-site.com/customer-service embedded in the iFrame I do see the page visit in the GA realtime overview.
When directly visiting our-site.com/customer-service GA is still working just fine:
Secure or SameSite value set (all "blank")...Is there anything I can do to make GA work again when running inside an iFrame on a foreign domain?
I just created a very simple test environment which also shows the issues described above:
our-site.com/customer-service
<html lang="en">
<head>
<!-- Global site tag (gtag.js) - Google Analytics -->
<script async src="https://www.googletagmanager.com/gtag/js?id={tracking-id}"></script>
<script>
window.dataLayer = window.dataLayer || [];
function gtag() { dataLayer.push(arguments); }
gtag("js", new Date());
gtag("config", "{tracking-id}");
</script>
<meta charset="UTF-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
<title>our site service</title>
</head>
<body>our-site.com/customer-service</body>
</html>
their-site.com
<html lang="en">
<head>
<meta charset="UTF-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
<title>their-site.com</title>
</head>
<body>
<iframe src="https://www.our-site.com/customer-service" style="width: 500px; height: 500px;"></iframe>
</body>
</html>
Even this very simple example shows the behavior described above, where opening our-site.com/customer-service directly, shows data in the GA realtime overview and opening their-site.com doesn't...
278
Without setting the samesite=none;secureflags in Google Analytics’ settings, the cookies created by GA would not be available in third-party context, thus messing with your ability to track the same user on the parent site and in the embedded resource.
The new cookieFlags field for Google Analytics allows you to set fields like SameSite and Secure on the Google Analytics cookies. The new cookieFlags field for Google Analytics allows you to set fields like SameSite and Secure on the Google Analytics cookies. Simo Ahava's blog Simo Ahava Husband | Father | Analytics developer
There are so manyscenarios where the first-party cookies used by Google Analytics need to be accessed in third-party context. These scenarios include, for example, embedded booking flows, embedded forms, and login portals.
I think you should ensure that SameSite flag is always set to None for those cookies. If it's initially set to Lax, and then you try to make it None, it may not work. Also, you should ensure that Secure flag is always set to true for SameSite=None cookies. It works for me, setting cookie via PHP; This is a HACK for php < 7.3 (!)
Answer from the Google tag manager support forum:
When accessing a first-party cookie (_ga) in a third-party context (the iframe), one has to explicitly add cookieFlags with the value samesite=none;secure.
Detailed description for various scenarios can be found at this blogpost.
134
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
