5 ms·
Wrong. :-P It's not about receiving, but about sending cookies to a third party. Let's say I visit marcosdumay.com, where you include some images and scripts fr
by andor 12y ago
Wrong. :-P It's not about receiving, but about sending cookies to a third party. Let's say I visit marcosdumay.com, where you include some images and scripts from other hosts on your page, and you want to know whether your visitors are logged into Facebook. Since marcosdumay.com != facebook.com, all content from Facebook on your page is third-party content.
How does Facebook track sessions again? Right, through cookies. If third-party cookies are disabled, and an img src tag on marcosdumay.com triggers a request to facebook.com, this request will not contain my Facebook session cookie, and I'll appear to be logged out, even when I'm not.
- marcosdumay 12y agoTake another look at the article. The attaker makes the browser send the Facebook authentication cookies to only Facebook.
- andor 12y agoYes of course, that's how cookies work. And disabling third-party cookies will stop the browser from receiving and sending to any third parties. In your browser, you have several options to deal with cookies: allow all of them, allow none, or disable third-party cookies only. Let's say I visit attacker-site.com, which includes both local content and stuff from other domains: attacker-site.com |`-- tracking-script.js |`-- tracking-image.gif |`-- facebook.com/me `--- twitter.com/tweet-button.png Content from other domains is third-party content by definition, and leads to third-party requests, in this case to facebook.com and twitter.com. If third-party cookies are disabled, those requests will will not include any cookies. Even if I'm logged in to Facebook, to attacker-site.com it will appear as if I'm not.