How to set a cookie for another domain

问题:

Say I have a website called a.com, and when a specific page of this site is loaded, say page link, I like to set a cookie for another site called b.com, then redirect the user to b.com.

I mean, on load of a.com/link I want to set a cookie for b.com and redirect user to b.com.

I tested it, and browser actually received the cookie from a.com/link, but it didn\'t send that cookie on the redirection request to b.com. Is it normal?

Can we set cookies for other domains?

回答1:

You cannot set cookies for another domain. Allowing this would present an enormous security flaw.

You need to get b.com to set the cookie. If a.com redirect the user to b.com/setcookie.php?c=value

The setcookie script could contain the following to set the cookie and redirect to the correct page on b.com

<?php
    setcookie(\'a\', $_GET[\'c\']);
    header(\"Location: b.com/landingpage.php\");
?>

回答2:

Similar to the top answer, but instead of redirecting to the page and back again which will cause a bad user experience you can set an image on domain A.

<img src=\"http://www.example.com/cookie.php?val=123\" style=\"display:none;\">

And then on domain B that is example.com in cookie.php you\'ll have the following code:

<?php
    setcookie(\'a\', $_GET[\'val\']);
?>

Hattip to Subin

回答3:

Probaly you can use Iframe for this. Facebook probably uses this technique. You can read more on this here. Stackoverflow uses similar technique, but with HTML5 local storage, more on this on their blog

回答4:

You can\'t. That would be a nasty security risk.

回答5:

Setting cookies for another domain is not possible.

If you want to pass data to another domain, you can encode this into the url.

a.com  ->  b.com/redirect?info=some+info (and set cookie) -> b.com/other+page

回答6:

see RFC6265:

The user agent will reject cookies unless the Domain attribute specifies a scope for the cookie that would include the origin server. For example, the user agent will accept a cookie with a Domain attribute of \"example.com\" or of \"foo.example.com\" from foo.example.com, but the user agent will not accept a cookie with a Domain attribute of \"bar.example.com\" or of \"baz.foo.example.com\".

NOTE: For security reasons, many user agents are configured to reject Domain attributes that correspond to \"public suffixes\". For example, some user agents will reject Domain attributes of \"com\" or \"co.uk\". (See Section 5.3 for more information.)

But the above mentioned workaround with image/iframe works, though it\'s not recommended due to its insecurity.

回答7:

In case you have a.my-company.com and b.my-company.com instead of just a.com and b.com you can issue a cookie for .my-company.com domain - it will be accepted and sent to both of the domains.

回答8:

You can\'t, but... If you own both pages then...

1) You can send the data via query params (http://siteB.com/?key=value)

2) You can create an iframe of Site B inside site A and you can send post messages from one place to the other. As Site B is the owner of site B cookies it will be able to set whatever value you need by processing the correct post message. (You should prevent other unwanted senders to send messages to you! that is up to you and the mechanism you decide to use to prevent that from happening)