views:

67

answers:

2

Hi i have a web application where i plant a cookie on my page. Then the user goes to another page, and from that page calls my page from a script, like this:

<script type="text/javascript" src="http://domain.com/page.aspx?id=6" ></script>

But i cant access the cookie when it calls my page, why not? and how to work around it?

Please note that this question is in relation to: http://stackoverflow.com/questions/2660427/javascript-and-webshop-tracking-affiliate-across-websites-how-to-do

Edit The "other" page is on a entirely different domain. My code is in ASP.NET, but as far as i know its the same for all languages:

Planting the cookie (Default.aspx):

protected void Page_Load(object sender, EventArgs e)
    {
        Response.Cookies["affiliate"].Value = "InnovationPartner";
        Response.Cookies["affiliate"].Expires = DateTime.Now.AddDays(7);
        ...
    }

Retrieving the cookie (after round-trip) (Collect.aspx):

protected void Page_Load(object sender, EventArgs e)
    {
        bool affiliate = Request.Cookies["affiliate"] != null ? true : false;
        ...
    }
A: 

Many browsers have options to place limitations on ‘third party cookies’, which is what your cookies are for a request caused by a <script> tag on another site.

In particular for IE's default settings, you will need to provide a P3P policy. See eg. this question.

bobince
...but i set my cookie on:http://www.mycomain.com/default.aspx-> user clicks a link and is redirected to another page (the webshop)-> When the user has completed order i link back to my domain(the javascript):http://www.mydomain.Collect.aspxAnd its on mydomain.com i am setting and retrieving cookies, nowhere else. But when i try to retrieve my cookie its not there (return null)
H4mm3rHead
..what i mean is that, its not a real third pary cookie, when its not used on the domain of the webshop?
H4mm3rHead
It's a third-party cookie when a resource (script, style, image, iframe) is being fetched from a web page at a hostname that does not match the hostname of the resource.
bobince
A: 

when called from the different domain, a P3P signature must be implemented.
Anyway, you must always watch an HTTP log to track the cookies flow

Col. Shrapnel