Iframe content does not use parent cookies when using srcdoc in Firefox, works in chrome

user_14842336 0
Viewed 444

I have a html structure like this

<html>
   <body>
     <iframe srcdoc="HTMLDOC"></iframe>
   <body>
</html>

where HTMLDOC is a HTML doc which has some <img> tags that show images in my server that the user must be authenticated to see.

This works flawlessly on Chrome, but when trying on Firefox the requests made from the browser to fetch these images do not send the user's cookies, and thus the images are not downloaded, (since the server thinks that the user is not authenticated).

If I convert the iframe to a "classic" iframe, like this:

<iframe src="URL INSIDE MY SERVER"></iframe>

where URL INSIDE MY SERVER is an endpoint that serves the same HTMLDOC it works both in Chrome and Firefox, sending the appropriate cookies in the requests to fetch the images.

I've tried as well to add the parameter sandbox="allow-same-origin allow-top-navigation allow-scripts" to the iframe using srcdoc, to no avail.

What's weird is that if this is a same-origin situation I can't think a clearer same-origin that having the page in the HTML itself, so I don't know if I'm missing something.

firefox iframe cookies
1 Answers

I'm not sure whether the implement differences between Chrome and Firefox are, but I use some DOM manipulations to bypass this issue:

<html>
  <body>
    <iframe onload="fillIframe(this);"></iframe>
  </body>
</html>

<script type="text/javascript">
  function fillIframe(o) {
    o.contentWindow.document.body.innerHTML = "HTMLDOC";
  }
</script>
user_123180370
Related