Strange Javascript/cross site cookies problem

Question

I've got a PHP script running on domain B that, when called generates some JS.

The idea is that in a given html page I can have:

<script src="http://b.domain/myscript.php"&gt;&lt;/script&gt;

So when the page loads, the script is called and the JS is generated and run on the local page.

The problem is that myscript.php depends on B's domain cookies. If I type http://b.domain/myscript.php into my address bar, the script works fine, and I see the JS text in the browser window.

But when I include the quoted line above in a webpage running on a different webserver, call it A, it doesnt work. The JS is still generated, but is incorrect, as none of the cookies are available to the script.

So, in short, access the script directly, cookies are available, all is well. Access the script via a call from a page served from another domain and it doesnt have access to the cookies.

I dont understand why, in a call to a script running on the B domain, the browser doesnt seem to be sending B's cookies?

Answer 1

This is a security feature. Cookie information is never made available to a domain other than the one that set the cookie. See: http://en.wikipedia.org/wiki/Cross-site_scripting for more info.