Click to See Complete Forum and Search --> : Cookie won't set from master domain
mkistler
03-03-2003, 11:19 AM
We are using cookies to identify returning customers. Our application runs on our server but the main url calls a different server that in turn loads our app.
When we access the app directly from our server (using ip address + web_app + page) the cookie is saved and accessible when returning. However, when we access the app through the main url (www.---.com) it will not set a cookie.
What do we need to do to set the cookie?
gil davis
03-03-2003, 11:39 AM
Some kind of server code. JavaScript cannot access cookies from another domain. It's a security limitation. You are probably writing the cookie, you just cannot read it from the other domain.
mkistler
03-03-2003, 11:46 AM
Thanks for your quick reply. I'm pretty sure it's not posting at all. I know where my cookies are kept, and nothing is written or updated when connected to the main url.
gil davis
03-03-2003, 11:59 AM
Post a link.
mkistler
03-03-2003, 12:05 PM
Master URL Connect - http://www.dfwbmwdirect.com/cookiemonster.htm
Direct Connect -
http://209.220.230.133/evps_bmw/cookiemonster.htm
These links access exactly the same page.
mkistler
03-03-2003, 12:07 PM
NOTE: My browser caches the page, so if I don't reload it fresh, it appears to read the values.
gil davis
03-03-2003, 01:23 PM
You didn't tell me it was in a frame.
I cannot prove this (I don't know how to prove it), but I believe you are still having security problems. Frames will inhibit Javascript across domains. The javascript in the frame exists in a different domain than the frameset itself. I don't think you get another set of cookies.
mkistler
03-03-2003, 01:36 PM
Thanks Gil. The frameset on the server is unfortunately not our property, but we will follow up on this with our customer and find out why they need to use the frames. I see no good reason for it. I appreciate the insight and will let you know what we discover.
mkistler
03-04-2003, 11:12 AM
I fixed it! Thank you for your help. The frame was indeed the problem. Even though I have no access to the original frame, I found that I could redirect myself with a page that contains only "top.location.href=" and the name of the original page we want. I don't know why, but the original frameset is gone and cookies are available.
Thanks again for the direction.