Home/ Questions/Q 3438322
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-18T08:10:23+00:00

Question originally posted on Webmasters , was recommended to move it here. I host

  • 0

Question originally posted on Webmasters, was recommended to move it here.

I host a webservice, and provide my members with a Javascript bookmarklet, which loads a JS sript from my server. However, clients must be logged in, in order to receive the JS script. This works for almost everybody. However, some users on setups (i.e. browser/OS) that are known to work for other people have the following problem: when they request the script via the javascript bookmarklet from my server, their cookie from my server does not get included with the request, and as such they are always “not authenticated”.

I’m making the request in the following way:

var myScript = eltCreate('script');
myScript.setAttribute('src','http://myserver.com/script');
document.body.appendChild(myScript);

In a fit of confused desperation, I changed the script page to simply output “My cookie has [x] elements” where [x] is count($_COOKIE) on http://myserver.example.com. If this subset of users requests the script using the above method encoded in the bookmarklet, the message reads “My cookie has 0 elements”. When they access the URL directly in their browser, the message reads “My cookie has 7 elements”.

What on earth could be going on?! And more importantly, how would I fix this?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    I’m pretty sure this is a privacy setting issue. The affected browsers probably have increased their privacy settings refusing 3rd party scripts from setting cookies.

    I’ve experience similar issues when placing an IFRAME pointing to domain B on a site hosted on domain A. Some browsers refused that my IFRAME set cookies for it’s own domain because it triggered a privacy issue.

    You might want to store a hash in the script src attribute and have it authenticate users that way.

    Edit: This is sort of what I’m talking about: Setting cross-domain cookies in Safari

    • 0