Page within iframe not seeing its own cookies

user_643951 0
Viewed 2406

I have a bit of an interesting dilemma.

We have 2 websites on separate domains. For simplicity, let's say they are:

  • "App": an SPA application running on main-app.com/app
  • "Host": a simple index.html page running on random-site.com/index.html. The index.html page contains only an iframe which displays the App (points to main-app.com/app).

When I, as a user, go to the App (main-app.com/app) and log in there, it sets a session cookie in my browser which identifies the session. However, when I go to the Host page (random-site.com/index.html) and it loads the App's iframe, the session cookie is not being sent. It is simply omitted when I look at it in the network inspector.

Why would this be happening? What is preventing the cookie from being sent, and how can we fix this?

(We have control over both sites)

content-security-policy web security cookies http
1 Answers

Are you using Google Chrome? In Google Chrome, the default attribute for cookies has been changed to samesite=lax. samesite=lax cookies are not sent in iframes. The purpose of this change is to mitigate attacks such as CSRF. If you use Firefox, you should still be logged in on the page in the iframe.

user_43139510
Related