6

I am implementing one advertising system in which when one user puts down script code into their website A. what I want to do at that time is set up a cookie into website A while it display response or resource of website B(Advertising System), so in present day when user comes again , I can log it's entry. I have read down this question and came to know that it is possible to set cookie into other website A when that website A is display content from another website B

In script I am executing one rest API and returning one response like below..

source_image = "http://example.com/media/format.png"
response = Response({'success':source_image})
response.set_cookie( 'cookie_name', 'cookie_value' )
return response

Now I am able to see cookie set in browser of the response of this url. But when I reload it ,cookie does not get display. Also why it is not getting display in the cookies section of the site in which I have put down script code.

Am I doing right thing to set up a cookie? And I have tried to set cookie's expiry date for 1 day. But still it is getting destroyed..Please help..

Community
  • 1
  • 1
Pawan
  • 4,249
  • 6
  • 27
  • 32

2 Answers2

1

There are a few important things to know about cookies and browsers and how they interact across domains.

  1. Websites can set cookies for their own website
  2. Websites cannot set cookies for a different website
  3. Cookies can be set on the response or using things such as JavaScript

The first two may seem confusing, especially when some sources say they are possible. It's important to note that they only affect cases where the response is directly setting the cookie using the Set-Cookie header, which allows a website to directly set a cookie. There are some special cases for things like subdomains, but in general you should not expect browsers to respect cookies set on other domains that you don't control.

If you were allowed to arbitrarily set cookies on other websites, this would open the door for websites to arbitrarily set and unset cookies you are using, even if they are unrelated. This would include the ability to log someone out across domains in just the response alone, which isn't possible.

The third point is important for cases like advertising, as cookies can be set using the Set-Cookie header (or response.set_cookie in Django) or using JavaScript through the document.cookie property. As JavaScript can included from any domain using the src property on <script> tags, any domain can manage cookies on another domain if it is included through JavaScript. This is important to how many analytics services, such as Google Analytics, work becuase it allows them to store unqiue cookies on each website for each user that is being monitored, even though they do not have full control over the response. They also typically use tracking beacons in the form of images to send data back to the external domain and associate it with the stored cookie.

The answer you linked to talks about this with images, but explains that it does not actually set the cookie on another domain. The cookie which is being set using the image or frame is stored only on the external domain, and cannot be accessed from the domain including the remote image.

Community
  • 1
  • 1
Kevin Brown-Silva
  • 40,873
  • 40
  • 203
  • 237
0
  • Make sure that the HTTP header of "Set-Cookie" is being passed to the client in the HTTP response.
  • Try adding in the "domain" attribute for the cookie so the browser knows where to send the cookie.
Mildred Clarke
  • 1
  • I have tried this response.set_cookie( 'cookie_name', 'cookie_value',domain='my_domain_name' ,max_age=31556926)..What do you mean by sending HTTP header? – Pawan Dec 25 '14 at 06:36
  • I am assuming that you are trying to get the cookie in a browser. If that is the case the the HTTP Response Header of "Set-Cookie" is needed so that when the response is parsed by the browser, it will use it. A packet capture should show something like "Set-Cookie" in the response if that is the case. – Mildred Clarke Dec 28 '14 at 06:03