PHP Session / Cookie in Frames Using Internet Explorer

Posted by on 11/18/2005 Leave a comment (47) Go to comments

For the last couple hours, I’ve been frustrated trying to figure out why I’m having an issue creating a session cookie with PHP while browsing with Internet Explorer.  This was testing some software for work that I wrote, or I wouldn’t have been using Internet Explorer emoticon.

Here is the problem that I ran into.  There is a master page that is being ran on a seperate server than the one that will be displaying this content.  The master page displays my servers content in one of the child frames.  When using internet explorer with the default privacy setting, Medium, I am not able to create a session due to the fact that a cookie will not be accepted by Internet Explorer.

I have found a solution to this problem.  The situation is that when the frame has been created by one server, and the child frame then loads content from a second server, Internet Explorer treats all cookies from the second server (in the child frame) as 3rd party cookies.  Under the Medium privacy level, cookies are not allowed from the secondary server because Internet Explorer "Blocks third-party cookies that do not have a compact privacy policy".  To fix this problem, a compact privacy policy must be added to the headers sent to the client before a cookie is attempted to be created.  The quick way is to just send this string in a header to the client ‘P3P: CP="CAO PSA OUR"’.  To get a better understanding of a compact privacy policy, you can go to http://www.w3.org/P3P/.  There is a bunch of commercial software out there to help you create fully detailed compact privacy policies, or you can use the free one that I found at http://www.the-dma.org/privacy/creating.shtml.

One thing to note is that this issue does not only occur with PHP.  Just happens that’s what I was developing with when I found the issue.  It will occur with any development language that tries to create cookies in the situation where a compact privacy policy does not exist, internet explorer is set on medium privacy level, and a frame page served by one server loads a child frame from another server. 

PHP
Leave a comment ?

47 Comments.

  1. crnbrdeater 9/6/2006 at 11:39 am

    I realize this is an older post but thanks anyway. You just saved me a bunch of time.

    Reply
  2. Lukree 10/13/2006 at 8:31 am

    Thanks a lot! This really saved me from redoing a lot of work! 😀

    Reply
  3. nEo.pk 11/2/2006 at 10:56 pm

    hmmm,, thats where i got stuck
    Thanks alot James,
    you saved my life =]

    Reply
  4. heron silva 1/29/2007 at 2:13 pm

    (trying again without html chars)

    ?php

    header(‘P3P: CP=”CAO PSA OUR”‘);

    ?

    Reply
  5. SAL Consultancy 1/31/2007 at 4:51 am

    On a different website I found this for PHP:

    header(‘P3P:CP=”IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT”‘);

    Just add it in the beginning of the page where the cookies are send out.

    Cheers

    Reply
  6. Yoshi 2/21/2007 at 1:53 am

    You have saved my life! LOL. Great!!!

    Reply
  7. Andriy 4/14/2007 at 4:07 pm

    Thank you. I lost many time for fix this but you did it.

    header(’P3P:CP=???IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT???‘);

    work fine for me

    Reply
  8. Ruben 4/17/2007 at 1:00 pm

    I LOVE YOU!!!!!!!!!!!!!!!!!!!!!!!!

    Reply
  9. Jose Carlos 5/3/2007 at 8:30 am

    Oh my God!!!
    Thank you James! Really!!
    I must invite you some day 🙂

    Reply
  10. Ramani 6/15/2007 at 4:28 pm

    Thank you!!Thank you!!Thank you!!

    I could treat you if you were nearby 😉

    Reply
  11. Chris Lively 7/13/2007 at 8:20 pm

    Thanks!
    I added this to the sites custom host headers (IIS Manager) and it worked great.

    Reply
  12. Victoria 8/20/2007 at 11:12 am

    THANK YOU!!! I had been searching for the solution to this problem for ages, and finally found it!! You saved me so much time & more frustration! THANK YOU THANK YOU

    Reply
  13. ary 9/13/2007 at 9:24 am

    Thank you very much!
    It solved my problem

    Reply
  14. Vlad 10/4/2007 at 5:40 am

    Thank you!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

    Reply
  15. Daan 11/2/2007 at 7:14 am

    Yeps ! Thanxz !

    header(’P3P:CP=???IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT???‘);

    Reply
  16. che 11/20/2007 at 5:15 pm

    I tried this and it worked: session_cache_limiter (‘private, must-revalidate’);

    Reply
  17. Arijit Pan 12/13/2007 at 12:05 pm

    Like others , many thanks.

    Reply
  18. Nick 12/14/2007 at 8:28 am

    Thank you so much! the header thing really really saved me from trying probably a ton of work arounds!!!!!!

    Reply
  19. Helene 1/3/2008 at 6:16 pm

    Thank you so much for taking the time to share this piece of information. I had a deadline today and you saved the day, and my life I think. Thanks for all that you do!!!!

    Reply
  20. Greg 1/17/2008 at 6:05 pm

    this just saved my rear! thanks

    Reply
  21. Franz 1/18/2008 at 7:38 am

    thank you that’s great, and this page is the first one when you search google for: “php session explorer”.
    :))

    Reply
  22. Herbert 2/5/2008 at 2:02 pm

    If you ever would like to have a beer, take a plane over to Stavanger, Norway, and I’ll buy you 🙂
    Thanks man!

    Reply
  23. Rod 2/21/2008 at 8:58 am

    Thanks James,

    This was a real life-saver.

    Reply
  24. Jeremy 2/22/2008 at 1:07 pm

    Thanks, you just saved me a ton of work!

    Reply
  25. Durgesh 2/27/2008 at 2:57 am

    Thanks a lot…..
    I tried it on local for framed site and it worked fine.
    Thanks a lot once agian..

    Reply
  26. eric 3/19/2008 at 10:05 pm

    thanks a lot…

    Reply
  27. Isak 3/26/2008 at 5:29 pm

    Hi,

    Thank’s a lot for the help!! It helped me along the way. Since we use .NET we couldn’t use the exact same solution, but i found another solution that works with .NET:

    http://petesbloggerama.blogspot.com/2007/08/aspnet-loss-of-session-cookies-with.html

    /isak

    Reply
  28. Peet 4/29/2008 at 9:40 am

    Thanks a lot…
    at last this issue is fixed !
    (i hate IE)

    Reply
  29. David 4/30/2008 at 10:25 am

    Thank you for your post. You save my life!! I waste 5 hours trying to solve this problem. Thankyou very much!

    Reply
  30. Arnau 5/23/2008 at 4:32 pm

    Man! You’re my hero! you saved me!!!!

    Reply
  31. Sergio Nate 5/27/2008 at 6:14 pm

    Thank you a lot!
    Your effort to share this info saved me from days of research.

    Reply
  32. wayne 6/13/2008 at 2:31 pm

    Unbeleivable ! Off and on for 3 or 4 days I have been struggling with this. I could not find and p3p info that helped me or forced me to read volumes of info. I simply wanted my session cookie to be readable when my site is loaded in an iFrame — how our partners license our product.

    Isak’s link pointed me to the solution for my .net app.

    Thank you !!

    Reply
  33. Adrian 6/24/2008 at 7:06 pm

    Use this!

    Reply
  34. Ã…sa 6/26/2008 at 2:17 am

    Thanks for posting your solution! This was a real nightmare before I found this page. :o)

    Reply
  35. Maarten 7/15/2008 at 11:07 am

    Hello,

    I am a complete novice regarding the use of session cookies of a website loaded in an iFrame. Actually to everything that has to do with programming (I’m more of a designer). I think that I came across the same problem as you guys and since I lack the experience I could really use some directions, here goes..

    At the moment I’ve got a page that is loading different pages(from other websites, not owned by me) through iFrames. Now, I’d like the user visiting my site to receive cookies from those
    ‘3rd’ party sites loaded within the iFrames.

    I’m also not sure if the code suggested will work in my situation, hopefully it does! Good to have read it worked
    for you guys though.

    My main question therefore is, where does that snippet of code go? I’ve got a simple .html page with iFrames, but it doesn’t work no matter where I put the code.

    Perhaps I need a different type of page, or is there a way around this or am I missing some vital coding?

    I’ve done some fair research and came across some programs that can generate a compact policy for me fit for my page’s purpose. Also I read that I have to configure my server for p3p. Is this all nesecairy? And if so, could someone bring up the patience and time to explain how?

    I hope you can help me with this problem.

    Kindest regards,

    Maarten

    Reply
  36. Dimith de Alwis 7/17/2008 at 10:18 am

    Many thanks.. Amazing! Solved the problem for me and saved my project..

    Reply
  37. Damien Westacott 7/23/2008 at 1:53 am

    I’ll add my voice to the chorus of thanks.

    Worth noting that my problem was actually relating to URL forwarding, which makes use of frames (I think). My session-reliant login system failed utterly under IE but worked on Firefox, until I added the new header. Worked like magic.

    Lifesaver.

    Reply
  38. John 10/2/2008 at 10:50 am

    People have been banging thier heads over this problem for the last couple of days…

    Thanks for posting up such concise explanation and solution.

    Isn’t the the internet great?

    Reply
  39. Diesel Station 11/9/2008 at 4:45 pm

    Man, you rock.. I was going nuts figuring out why sessions don’t work in IE but they do in firefox. Adding just header(‘P3P: CP=”CAO PSA OUR”‘); to top of code got it going.. Great… Thanks a bunch.

    Reply
  40. thatch 11/10/2008 at 6:34 am

    thanks alot for this fix, saved my bacon

    Reply
  41. Matthew 12/16/2008 at 9:21 pm

    Thanks a ton for that fix!

    Reply
  42. Tony Freixas 12/31/2008 at 8:56 pm

    Hmmm…I don’t usually comment on a 3-year old post, but it seems that people are still finding this (I did).

    The problem is not just on IE, and using the P3P header won’t necessarily fix this on IE.

    On Firefox, you will get the same problem if the user blocks 3rd-party cookies. On IE, you will get the problem. even with the compact privacy policy, if the user blocks all 3rd-party cookies (requires using the Advanced option on the Privacy tab).

    I’m still hunting for a solution.

    Reply
  44. Ian 4/13/2009 at 11:42 pm

    Thanks man! You are the one!

    Reply
  45. John McCain 5/25/2009 at 6:58 am

    Thanks man, this post almost saved my life, I’m starting to love you! 😛

    Reply
  46. Craig James 12/21/2009 at 1:09 pm

    Let me add to the chorus: Thank You! There are still copies of IE6 floating around out there, and a major customer is using them. Your post saved me a lot of time.

    Reply
  47. Raul Avila 2/23/2010 at 2:34 pm

    header(‘P3P:CP=”CAO PSA IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT”‘);

    Just paste it on the first php file that is called by the iframe

    Reply

Leave a Comment


NOTE - You can use these HTML tags and attributes:
<a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>