Loses session state in iframe, but not in pop-up window

Question

We're developing a web shop, and process payments with a third party UI.

We have chosen to show the payment UI inside an iframe inside out check-out page, even though (we now realize), the payment solution provider recommend using a top-level window.

Now what happens is that in IE7/IE8, the payment UI loses session state on the first postback (inside the iframe), while in Firefox, it works just fine. We observe that the payment UI is developed using ASP.NET.

I was under the impression that as far as the server is concerned, there is no difference between being referenced from an iframe versus from a top-level window, but clearly there is.

Does anyone have a clue? What does an iframe do that could possibly make a difference to the payment server, causing it to lose session state?

Could it (it suddenly dawns on me) be differences in cookie handling? Stricter security perhaps?

Answer 1

Probably caused by this:

Internet Explorer 6 introduced support for the Platform for Privacy Preferences (P3P) Project. The P3P standard notes that if a FRAMESET or a parent window references another site inside a FRAME or inside a child window, the child site is considered third party content. Internet Explorer, which uses the default privacy setting of Medium, silently rejects cookies sent from third party sites.

http://support.microsoft.com/kb/323752/en-us

I once heard someone say that an IFrame is actually a new instance of IE, but apparently it's a bit more complicated.

Answer 2

You might find this article by Milan Negovan helpful to explain why framed pages get a separate Session ID. The article also talks about the P3P solution mentioned by Gerrie Schenck above.