IE, P3P, IFrame and blocked cookies (works until page host page has personal information requested)

Question

My company has a little widget that plugs into shopping carts. We are running into a problem where setting cookies in IE7 is not working. This is happening because we are a 3rd party because we are embedded into the site via an iframe.

I have seen several post that say the way to solve this problem is by putting a P3P compact policy in the header. As mentioned:

http://stackoverflow.com/questions/389456/cookie-blocked-not-saved-in-iframe-in-internet-explorer

I have verified that my P3P policy is in my HTTP header. And it actually works for the first page/step of the shopping cart site, but as soon as there is personal information on the page (like name, address, phone, etc), IE blocks my site and my cookie.

I have tried several different P3P policies and they all don't work at the same place. I have also used the IBM P3P tool to generate my own special P3P policy, but it still doesn't work.

I am at a complete loss.

Any help is appreciated. Thank you.

David

Answer 1

Hi David

I had a similar isssues smoetime back and I myself have asked this question. We had a similar situation like yours. Make sure you add the p3p header to all the pages inside the iframe. I ahev written a blog post about it too. Check it if you are interested. Let me know how it goes.

Answer 2

The Fiddler web debugger (www.fiddler2.com) has a "Privacy" inspector tab on the response which decodes the P3P tokens into their meanings. There's a link at the bottom of the inspector which points to the MSDN article that shows which policies are considered "acceptable" by default.

Note, of course, that P3P policies are a Legal declaration, so you must be sure that your use of cookies matches what you claim in P3P.

Answer 3

This probably won't help anyone else, but I was banging my head against the wall for weeks over this one. It turns out that IE 7 won't allow 3rd-party cookies to be set, even with a valid P3P compact policy if the HTML meta tag for Content-Type has a different character set declaration on the page with the iframe from the page within the iframe.

Answer 4

Respected,
I have a page aspx with an internal iframe that should receive pages called by menu of the type: ul id="menu" li a href= ecaff1.aspx target=iframe1> E C C A F /a> /li> li>< ........ /ul> ". The iframe is iframe id="iframe1" style="width:748px; height:416px" runat="server" scrolling="yes" /iframe> ".
In the firefox and chrome it perfectly works. And in IE8 it doesn't work, the page opens in another window.
It includes the directing HttpContext.Current.Response.AddHeader("p3p","CP=\"IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT\""); in the load aspx-cs and it continues not working in IE, IN LOCAL HOSTING.

I request help for that problem. Adim.