frames and cookies

[scorpion]

I've noticed in IE 6 under medium privacy settings that if you load a URL in the frame SRC tag and it sets a 3rd party cookie, it will be blocked. Other's noticed this?

My question is: is there any way around this AND is this behaviour the same if use the new iframe tag?

[hakre]

hi scorpion, i don't think you'll like the answer but there is no way around this.

if you need to direct to a third server, this won't work. but maybe you can cookie-transfer the request, so the page is hosted on a third server, but the request is to a script on your page which delivers content and cookies from the third server.

another possibility seems to look at the various bug reports about the ie and to pick one bug out which makes it possible, but i don't know any specifc.

-hakre

[Mike12345]

You could run a script to prompt the user to change their settings, ive done this and wouldtn do it unless absoloutly necessary, which it very rarely is.

[vincevincevince]

but there is no way around this.

wrong, just set a compact privacy policy in your headers. i use (from php):

header("P3P: policyref=\"http://www.example.com/w3c/p3p.xml\",   CP=\"NOI DSP COR NID PSAa OUR IND NAV\"");

and that means that it will not reject the cookie

[scorpion]

in your example, "www.example.com" is your own website with a p3p.xml file? Or is there a site you can point all your requests to on the Web?

[scorpion]

Actually your example won't work in my case. Here's why...

If you set a policy on your server and you are redirecting in a frame to a 3rd party - then the policy must be set by the 3RD PARTY, not YOU because they are setting the cookie not you.

The use for your example seems to be if you are setting a cookie on your server and somebody is loading that page on THEIR server but not vice versa.

Is this correct?