Cross domain local storage using iframes - "Block third-party cookies"

Viewed 3389

There are already a few questions related to using the local storage with iframes to be able to share data across different domains. However, none of them addresses the issue when the "Block third-party cookies" is enabled.

Currently, by default now Chrome uses the option "Block third-party cookies in Incognito" which breaks the localStorage use within iframes whenever you use the incognito mode.

Is there any workaround for this problem? We're using post message to send the data for the iframe.

1 Answers

The behavior you are describing sounds exactly like the pattern of behavior the Third-Party Cookie Block is intended to prevent.

There have been numerous changes in Chrome (and other browsers) regarding cookies and iframe.

The basics of what is changing is there is now a 'SameSite' cookie policy, where Only cookies set as SameSite=None; Secure will be available in third-party contexts, provided they are being accessed from secure connections.

Also in safari, the third-party frame will have to request access to the storage API before the cookie will be accessible.

Firefox is using a partitioned approach to the storage, and so the frame will behave as normal unless you then open your application as a new window then the cookie store may or may not follow depending on how the new window was created.

Cookie Status is an excellent resource to track how third party cookies work in the different browsers and what you should change to make it work.

Related