Does disabling third party cookies also disable cookies created by third party javasript?

Question

When a page includes third party javascript (via script src=...) and that javascript that sets a cookie, that cookie "becomes" a first party cookie, even though it's originally set by a third party source.

My question is this. If someone has disabled third party cookies in their browser, does that also apply cookies set by third party javascript? Or does it only block cookies that are explicitly set in the headers for requests to the third party domain?

And either way, do all browsers handle this the exact same way or do some block javascript cookies but others allow it?

Answer 1

I believe most browsers do not differentiate between cookies for a domain set in the HTTP headers vs. ones set by javascript when it comes to enabling/disabling them via user preferences. There certainly COULD be exceptions -- there's no technical reasons preventing someone from extending a browser such that it has different rules for cookies based on exactly where the cookie originated -- but I'm not aware of any.

EDIT: I think I originally misunderstood your question -- I thought you were asking the difference between cookies set via HTTP headers and cookies set via javascript. Rather, you are asking whether a cookie set by javascript which is hosted at a different domain is considered a third-party cookie vs. a cookie that is set by javascript directly inlined in the page or hosted on the same domain? If that is the case, I believe the answer is no (that is, they are treated as first-party cookies). Regardless of the original domain where the js file is hosted, it is executed in the context of the web page which is including it, so it's considered first-party.

Answer 2

I just thought I'd update this after further testing, in case anyone comes across it later.

I tested Firefox 3.6, MSIE 7, Safari 4, Chrome 4, and Opera 10, and they all do in fact support creating cookies via third party javascript, even when third party cookies are disabled. I conclude this is because the cookies are created for the first party domain, so the browsers treat them as first party cookies, even though they are created by a script from a third party source.

It's only cookies created by headers from third party requests that get rejected when this feature is enabled.