1

My Angular 6 site uses an iframe to display another website's resources. The source of the iframe is the url to the resource I want, and the src gets changed dynamically if the users click on a different button. The first time the third-party site is hit using the iframe a basic authenticating process occurs

I ask for a resource
I am redirected to their authorization URL
They ask for authorization
I provide them my token
They give me a token as proof of authenticating and redirect back to resource

This method works great in Chrome, and I can view the third-party page's resources just fine. However in IE it does not work until I reduce the default internet security settings. What I think happens is the default settings are blocking third-party cookies, so the third party site can never send me proof that I am a valid user of their resources and thus they never show.

Is there a way for my domain to claim cookies from their domain as first-party cookies somehow? This way I can get around the IE default settings shutting me down.

bump

sideshowbarker
  • 81,827
  • 26
  • 193
  • 197
skyleguy
  • 979
  • 3
  • 19
  • 35

1 Answers1

0

So it turns out Windows 7 with IE 11 still requires something called P3P for third-party cookies to not be blocked.

Basically how third-party cookies used to be handled was the issuer of the cookie had to have a privacy policy created and hosted somewhere, like 'example.com/policy.html'. This policy is a disclaimer telling users how their data is being used. The issuer had to send a header with that link as its value to allow browsers to accept their cookies. The browser 'trusted' the cookie because it had a policy the user can look up to see how their data is being used. From some other stack overflow questions I found that this P3P business is extremely outdated and not many entities care much about it. We also don't even really need to worry about the policy at the url actually existing anymore.

I had to ask the external site to add the following header to all responses that contained a cookie:

P3P: CP="Test"

Where "Test" can be literally anything else and it worked!

Resources:

Cookie blocked/not saved in IFRAME in Internet Explorer

https://security.stackexchange.com/questions/153084/is-it-ok-to-turn-off-p3p-in-ie11-on-windows-7

skyleguy
  • 979
  • 3
  • 19
  • 35