views:

515

answers:

2

I have a facebook Iframe application with multiple PHP pages in it.

I have some links that point relatively to the files inside my "iframe folder".

Having some issues with session variables inside the iframe. I set some session variables but they do not persist from one page to another.

This does work on other browsers.

I've been reading that Safari does not support Cross-Domain cookies and this might be the problem , but im not sure how to fix this.

Any help?

A: 

I am having this same exact problem in Safari. Totally unrealistic to ask visitors to accept cookies from all in their preferences. I am on Rails. Blogs such as http://lightyearsoftware.com/blog/2009/11/on-the-pain-of-developing-for-facebook/ suggest possibly that rack could be the params killer from page to page, but I tried my facebook app on Rails 2.2.2 and still the same problem...

Dominic
Did you find any solution?
cdpnet
A: 

I wrote the blog post Dominic refers to in his answer.

The problem is that the default behavior of Safari is to only accept cookies from sites that you visit. This excludes "third party" cookies. Safari treats the page inside an IFRAME as a third-party site, and until you interact with that content (by clicking a link, for example), it will refuse those cookies.

Your PHP code needs to set a cookie on the first page that uses the session in order for that session to persist from one page to another, but if the session variables are in the very first page in the IFRAME, you have a chicken-and-egg problem.

My solution is to retain all of the special Facebook parameters through to the second page loaded into the IFRAME. Because you've interacted with it, cookies set on the second page will persist, and this allows your PHP code to keep whatever state it needs to communicate back to Facebook.

This won't likely help your PHP session, though, so I suggest adding another parameter to links on the first page that allows the second page to look the session up, or otherwise recreate it.

Steve Madsen
Steve, I'm using Single-Sign On facebook authentication. Facebook sets the cookie for my hosted domain to provide single-sign on. But, exactly as you mentioned, safari would reject it. And the app is left with the problem of no cookie from facebook. If I was setting the cookie, it's different scenario.
cdpnet