iansltx/_safari-iframe-cookie-workaround.md

## _safari-iframe-cookie-workaround.md

      
    Raw
  

              _safari-iframe-cookie-workaround.md
            
          
    Safari iframe cookie workaround

Safari by default discards cookies set in an iframe unless the host that's serving the iframe has set a cookie before, outside the iframe. Safari is the only browser that does this.
The 10k foot view

In order to get around the issue, the parent (src) and child/iframed/remote (dest) site have to work together, if the source site only wants users to access the destination via the iframe and can't assume that the user has visited the destination host before.
Normally, a user would navigate from page A, with no external iframe, to page B, with an external iframe, by clicking a direct link between the two. To make the workaround work, the link from page A is instead a "bounce" URL on the destination site, which sets a cookie (no requirements on name, value, etc.) and redirects back to page B. The redirect can be hard-coded for security, or left more open.
The warning

The following files are a naive example of the problem/solution. You'll want to think through your solution more carefully...don't copy-paste these snippets into a production setting! I haven't thought through the security ramifications of what's shown here...which means that there are some, and they aren't good. You've been warned.
The implementation details

This gist includes an implementation of both source and destination sides of the above workaround, including a test to make sure that it actually works. To see the fix in action, place src.php on one host, dest_xxx.php on another, then edit lines 2 and 3 on src.php to reference where those files show up.
To see the Safari problem without the solution, on a new Safari browser, navigate to src.php?redirected=true on a "clean" Safari. By "clean" we mean that Safari has never had a cookie (successfully) set by the destination domain before. The easiest way to do this is to fire up a Safari-powered instance on BrowserStack or the like.
When you load the page, you'll get an iframe. Click the link inside the iframe and you'll be greeted with a "Cookie not set!" message.
To see the solution, navigate to src.php (without the query string parameter) in the same browser (since the cookie wasn't successfully set, there's no need to set up a new clean Safari instance, though you can if you like). Then click the "Bounce here..." link. The browser will hit the remote site, which will set a blank cookie and redirect back to src.php?redirected=true.
When you click the link inside the iframe this time, you'll get "Cookies match!".
Note that if you use some browser (Chrome, Firefox, IE) other than Safari, you can just hit src.php?redirected=true and get "Cookies match!" without having to first go through the redirect.
The credits

This issue was discovered, and its solution devised, while working on Parking Mobility (https://parkingmobility.com).

  
## dest_bounce.php
<?php
header("Location: " . $_GET['redirect']);
setcookie("__trust");

## dest_get.php
<?php
if (!isset($_COOKIE['testcookie']))
    echo "Cookie not set!";
else if ($_COOKIE['testcookie'] != $_GET['cookie'])
    echo "Cookies don't match: " . $_COOKIE['testcookie'] . ' != ' . $_GET['cookie'];
else
    echo "Cookies match!";

## dest_set.php
<?php
$value = uniqid();
setcookie("testcookie", $value);
echo "<p>Now go <a href='dest_get.php?cookie=" . $value . "'>here</a></p>";

## src.php
<?php
$internalPath = "http://local.test/path";
$externalPath = "http://remote.test/path";
?>

<html><head><title>Redirect Cookie Test</title></head>
<body>
    <?php if ($_GET['redirected']): ?>
        <p>iframe starts below...</p>
        <iframe src="<?= $externalPath ?>/dest_set.php"?>
    <?php else: ?>
        <a href="<?= $externalPath ?>/dest_bounce.php?redirect=<?= $internalPath ?>/src.php?redirected=true">Bounce here...</a>
    <?php endif; ?>
</body>
	<?php
	header("Location: " . $_GET['redirect']);
	setcookie("__trust");
	<?php
	if (!isset($_COOKIE['testcookie']))
	echo "Cookie not set!";
	else if ($_COOKIE['testcookie'] != $_GET['cookie'])
	echo "Cookies don't match: " . $_COOKIE['testcookie'] . ' != ' . $_GET['cookie'];
	else
	echo "Cookies match!";
	<?php
	$value = uniqid();
	setcookie("testcookie", $value);
	echo "<p>Now go <a href='dest_get.php?cookie=" . $value . "'>here</a></p>";
	<?php
	$internalPath = "http://local.test/path";
	$externalPath = "http://remote.test/path";
	?>

	<html><head><title>Redirect Cookie Test</title></head>
	<body>
	<?php if ($_GET['redirected']): ?>
	<p>iframe starts below...</p>
	<iframe src="<?= $externalPath ?>/dest_set.php"?>
	<?php else: ?>
	<a href="<?= $externalPath ?>/dest_bounce.php?redirect=<?= $internalPath ?>/src.php?redirected=true">Bounce here...</a>
	<?php endif; ?>
	</body>