5 ms·

The other answers to your question are technically all feasible, but are all extremely unlikely to be how this was actually done. This is just what third party

by yahelc 13y ago

The other answers to your question are technically all feasible, but are all extremely unlikely to be how this was actually done. This is just what third party cookies are. Cookies set from the server-side (ie, the Set-Cookie header) can set whatever domain they want -- and if that cookie happens to not match the domain of the page you're on, that's what's called a third party cookie. Some browsers (primarily Safari IIRC), however, will automatically reject those cookies, either in all instances or depending on if you've interacted with that domain before.

sopooneo 13y ago
Thank you, and I appreciate learning. But I think I'm reading something else on wikipedia. The article there says you can only set cookies on "the top domain and its subdomains" [1] and that third party cookies are those set by page assets (like images within a page) that are served from a different domain. [2] What do you think? [1] http://en.wikipedia.org/wiki/HTTP_cookie#Domain_and_Path http://en.wikipedia.org/wiki/HTTP_cookie#Domain_and_Path [2] http://en.wikipedia.org/wiki/HTTP_cookie#Third-party_cookie http://en.wikipedia.org/wiki/HTTP_cookie#Third-party_cookie
- judk 13y ago
  You are correct. Parent is mistaken.
  - yahelc 13y ago
    My point was that the domain of the top URL you're on isn't relevant. Should have been clearer that the domain of the request itself needs to match.
- yahelc 13y ago
  Ah, yes. I should have been clearer in my comment. Obviously, the request needs to be served from the domain or subdomain in question, but it doesn't need match the URL of the page you're on, and it doesn't need to be an iframe, nor be set by JavaScript. It can be a simple image request; doesn't need to be an iframe, and doesn't need to involve complex JavaScript. My point was that it doesn't need to require much complexity at all; just an HTTP request served by the domain in question that passes along the cookies that need to be served from the new domain.

by yahelc 13y ago

sopooneo 13y ago

Thank you, and I appreciate learning. But I think I'm reading something else on wikipedia. The article there says you can only set cookies on "the top domain and its subdomains" [1] and that third party cookies are those set by page assets (like images within a page) that are served from a different domain. [2] What do you think? [1] http://en.wikipedia.org/wiki/HTTP_cookie#Domain_and_Path http://en.wikipedia.org/wiki/HTTP_cookie#Domain_and_Path [2] http://en.wikipedia.org/wiki/HTTP_cookie#Third-party_cookie http://en.wikipedia.org/wiki/HTTP_cookie#Third-party_cookie

judk 13y ago
You are correct. Parent is mistaken.
- yahelc 13y ago
  My point was that the domain of the top URL you're on isn't relevant. Should have been clearer that the domain of the request itself needs to match.
yahelc 13y ago
Ah, yes. I should have been clearer in my comment. Obviously, the request needs to be served from the domain or subdomain in question, but it doesn't need match the URL of the page you're on, and it doesn't need to be an iframe, nor be set by JavaScript. It can be a simple image request; doesn't need to be an iframe, and doesn't need to involve complex JavaScript. My point was that it doesn't need to require much complexity at all; just an HTTP request served by the domain in question that passes along the cookies that need to be served from the new domain.