unvast.blogg.se

• #Satisfactory explorer how to

#Satisfactory explorer how to

How to solve it Create a p3p policyĪ good starting point is the W3C tutorial. It is possible to make the page inside the IFRAME more trusted: if the inner page sends a P3P header with a privacy policy that is acceptable to IE, the cookies will be accepted. This would have worked, but for political reasons I couldn't do that.) (I've tried setting the session identifier into the form and loading it from POST variables. In this case, when cookies are blocked, session identifier is not sent, and the target script throws a 'session not found' error. If the page inside the IFRAME doesn't have a Privacy Policy, its cookies are blocked (which is indicated by the eye icon in status bar, when you click on it, it shows you a list of blocked URLs). What's happeningĪs it is, Internet Explorer gives lower level of trust to IFRAME pages (IE calls this "third-party" content). I got it to work, but the solution is a bit complex, so bear with me. I don't want my applications to use a combination of bug+security hole just because it's easy.Įdit: the P3P policy was the root cause, full explanation below. Set-Cookie: ASPKSJIUIUGF=JKHJUHVGFYTTYFY), but on POST /process.asp request, there is no Cookie header at all.Įdit3: some AJAX+serverside scripting is apparently capable to sidestep the problem, but that looks very much like a bug, plus it opens a whole new set of security holes. Results of sniffing the HTTP traffic: on GET /someform.asp response, there's a valid per-session Set-Cookie header (e.g. Į uses cookie-based sessions (and there's nothing I can do about that), so without cookies, process.asp won't execute.

In Firefox this problem doesn't appear.įor testing purposes, I've created a similar setup on. However, when I load someform.asp as an IFRAME in IE 6 or IE 7, the cookies for are not saved.

When I open the form (" someform.asp") in its own browser window, all works well. That IFRAME displays a form for the user to fill out and submit to. I have two websites, let's say they're and.