7 ms·

I'm genuinely curious about your assertion. Let's say I have an application for my business and I want to embedded a report on one of my pages from a separate

I'm genuinely curious about your assertion. Let's say I have an application for my business and I want to embedded a report on one of my pages from a separate application. This other application is a SaaS application, so I can't just "mount" it at mydomain/some-sub-path. How do I have secure reports without third-party cookies? Store cookie-like stateless tokens in my wrapping app and send them in the URL?

a1369209993 7y ago
Assuming I'm understanding your question correctly, yes, you would have something like: <iframe src="https://saasapp.com/report?url= https://mydomain.com/data/1234.json%3F v%3D42%26auth%3D__79_Pv6-fj39vX08_Lx8A++"/> (spaces added for readability)
- tetraca 7y ago
  Cool, if third party tracking cookies are "defeated", this will be the next step in the arms race.
  - a1369209993 7y ago
    This site includes content from saasapp.com: [Whitelist INC saasapp.com From mydomain.com] [Blacklist saasapp.com] [Allow once] [Ignore]
    - tetraca 7y ago
      I'd be happy with that.
    - baroffoos 7y ago
      That could work well because if the message shows the domain that looks like the content they want to see they will allow it but if its a random tracker domain they will block it.
      - a1369209993 7y ago
        It's also important to not include [Whitelist INC i.imgur.com], only [Whitelist INC i.imgur.com FROM example.com], because trackers will adapt to exploit the first one as soon as it's common enough to be noteworthy.
  - yholio 7y ago
    If browsers break 3rd party cookies and they are not fingerprintable, the arms race stops: there is no way to track a client across multiple sites, other than weak correlations with IP, interests, etc.
Tepix 7y ago
If it's inside your business you can use subdomains like site1.domain.com and site2.domain.com and set the cookie domain attribute to domain.com and you will not have a problem because the cookie will be visible among all the sites of your domain.

a1369209993 7y ago

Assuming I'm understanding your question correctly, yes, you would have something like: <iframe src="https://saasapp.com/report?url= https://mydomain.com/data/1234.json%3F v%3D42%26auth%3D__79_Pv6-fj39vX08_Lx8A++"/> (spaces added for readability)

tetraca 7y ago
Cool, if third party tracking cookies are "defeated", this will be the next step in the arms race.
- a1369209993 7y ago
  This site includes content from saasapp.com: [Whitelist INC saasapp.com From mydomain.com] [Blacklist saasapp.com] [Allow once] [Ignore]
  - tetraca 7y ago
    I'd be happy with that.
  - baroffoos 7y ago
    That could work well because if the message shows the domain that looks like the content they want to see they will allow it but if its a random tracker domain they will block it.
    - a1369209993 7y ago
      It's also important to not include [Whitelist INC i.imgur.com], only [Whitelist INC i.imgur.com FROM example.com], because trackers will adapt to exploit the first one as soon as it's common enough to be noteworthy.
- yholio 7y ago
  If browsers break 3rd party cookies and they are not fingerprintable, the arms race stops: there is no way to track a client across multiple sites, other than weak correlations with IP, interests, etc.

Tepix 7y ago

If it's inside your business you can use subdomains like site1.domain.com and site2.domain.com and set the cookie domain attribute to domain.com and you will not have a problem because the cookie will be visible among all the sites of your domain.