Member Avatar for anish.anick

Hi All,

I have a web site where few pages are shown inside an IFrame.. The problem is with session in IE.. How can i get session in IE IFrames... Pls help

Thanks

  • 3 Contributors
  • 2 Replies
  • 122 Views
  • 1 Year Discussion Span
  • Latest Post Latest Post by chaitanya_ysk

Dani AI

Generated

anish.anick reported a classic IE/iframe symptom: the session cookie is not being sent when the page is hosted inside an iframe. As noted, many people used a P3P compact-policy header as a workaround and confirmed it worked here. That fix is a historical, browser-specific workaround rather than a general solution.

Why it happens: when the iframe is served from a different origin the cookie becomes a third‑party cookie and IE’s privacy rules can block it. Modern browsers have moved to cookie attributes such as SameSite and stricter defaults for third‑party cookies, so relying on browser hacks is brittle. See the P3P spec and the modern SameSite behavior for context: P3P (W3C) and SameSite cookie attribute (MDN).

Practical checklist to diagnose and fix (apply in order):

  • Confirm whether the iframe origin differs from the top-level page. If same origin, cookies should be first‑party.
  • Capture traffic (IE F12 or Fiddler) and inspect the Set-Cookie response and the Cookie header on subsequent requests to the iframe.
  • Check cookie attributes (domain, path, Secure, HttpOnly, SameSite). Modern browsers require SameSite=None; Secure for third‑party cookies.
  • Check IE privacy settings (Tools → Internet Options → Privacy) on the client machine.
  • If you control both sites, prefer serving the iframe content under the same registrable domain (use subdomains and set the cookie domain to the parent), or use a token-based approach (SSO) or short-lived token delivery via postMessage.

A safer cross-origin pattern is to keep authentication at top level and pass a short-lived token to the iframe using postMessage (validate origin and use HTTPS). See the postMessage docs for a secure pattern: Window.postMessage (MDN).

Note: P3P headers will still work in some IE configurations but are nonstandard and fragile. Prefer same-domain cookies, SSO/token flows, or secure message-passing for long-term reliability.

Recommended Answers

All 2 Replies

Member Avatar for AleMonteiro

This is a known bug, to fix add this code inside the On_Init event.

Response.AddHeader( "p3p", "CP=\"IDC DSP COR ADM DEVi TATi PSA PSD IVAi IVDi CONi HIS OUR IND CNT\"" );

I suggest that you put in on a master page or, as I do: I extend the System.Web.UI.Page and override the function:

//---------------------
        // OnInit 
        //---------------------
        protected override void OnInit ( EventArgs e )
        {
            // Header para resolver problema de sessão dentro de frames
            Response.AddHeader( "p3p", "CP=\"IDC DSP COR ADM DEVi TATi PSA PSD IVAi IVDi CONi HIS OUR IND CNT\"" );
        }

Then in my page I use this class as the base.

Hope it helps!

Member Avatar for chaitanya_ysk

Thank you very much. It worked perfectly.

Regards,
Chaitanya.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.