iframe 不读取 Chrome 中的 cookie [英] iframe not reading cookies in Chrome

问题描述

Chrome 不允许子 iframe 读取自己的 cookie.

我有一个带有子 iframe 的父网页:

• 位于 https://first-site.com
的家长
• <iframe src="https://second-site.com"> 的孩子(在父级内部)
• cookie 设置为
  • 路径:'/'
  • 安全:真实
  • httpOnly:假
  • 域:'.second-site.com'

我控制这两个站点，并且我希望 iframe 在 iframe 内执行需要读取 .second-site.com cookie 的操作.外部父级不需要对此了解任何信息.

它适用于除 Chrome 之外的所有浏览器.

Chrome 根本不会向孩子提供子页面自己的 cookie.

在自己的窗口中访问子页面并在所有浏览器中执行操作，包括Chrome.

我已经在所有排列中尝试了这两个选项:

• 为 cookie 设置 secure:false 或 secure:true
• 为 iframe 设置 sandbox="allow-same-origin allow-scripts"，或删除 sandbox 属性

Chrome 有什么不同之处，Chrome 中的 iframe 如何访问自己的 cookie?

解决方案

我的服务器自动设置了一个名为 SameSite 的相对较新的 cookie 属性.禁用此功能(同时保留问题中列出的设置)允许 iframe 在 Chrome 中访问其自己的 cookie.

另请参阅 Chrome 功能状态 &IETF 草案

2020 年 8 月更新

Chrome 现在会在未设置 SameSite 的情况下阻止 cookie，因此您需要将其明确设置为 samesite=none 和 secure=true.

Chrome is not allowing a child iframe to read its own cookies.

I have a parent webpage with a child iframe:

• parent at https://first-site.com
• child at <iframe src="https://second-site.com"> (inside of parent)
• cookie set with
  • path: '/'
  • secure: true
  • httpOnly: false
  • domain: '.second-site.com'

I control both sites, and I want the iframe to perform an operation within the iframe that requires reading cookies for .second-site.com. The outer parent doesn't need to know anything about this.

It works in all browsers except for Chrome.

Chrome is simply not making the child page's own cookies available to the child.

Visiting the child page in its own window and performing the operation works in all browsers, including Chrome.

I've tried both of these options in all permutations:

• Set secure:false or secure:true for the cookie
• Set sandbox="allow-same-origin allow-scripts" for the iframe, or remove the sandbox attribute

What is Chrome doing differently, and how can an iframe in Chrome access its own cookies?

解决方案

There is a relatively new cookie attribute called SameSite that was being set by my server automatically. Disabling this (while retaining the settings listed in the question) allows the iframe access to its own cookies in Chrome.

See also Chrome feature status & IETF draft

UPDATE Aug 2020

Chrome now blocks cookies without SameSite set, so you need to explicitly set it to samesite=none and secure=true.

这篇关于iframe 不读取 Chrome 中的 cookie的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！