That depends on the definition of "disabling third party cookies". If you are logged in Facebook, the facebook.com cookie is now first-party (because you visit

That depends on the definition of "disabling third party cookies". If you are logged in Facebook, the facebook.com cookie is now first-party (because you visited facebook.com) and it is sent each time you make a request to Facebook from other domains. Blocking third party cookies usually mean that you block cookies from domain that you never directly visited (although Firefox has an option to disable ALL third-party cookies, even those from sites you visited [1]). If the browser prevented sending cookies on cross-domain requests, it would block all authenticated cross-domain calls and that would severely limit the possible integration of web sites and applications. You could still pass session ids in the URL, but these can be sniffed by other servers, e.g., with the REFERER header. [1] https://support.mozilla.org/en-US/kb/disable-third-party-cookies https://support.mozilla.org/en-US/kb/disable-third-party-coo...