Implement p3p headers - Cross-Site (Domain) iFrames

With ever growing popularity of widget based sites, I think, there is a trend of using iFrames in lot of web sites to show content/applications across domains. There are challenges though and one common one being that the cookies from the iFrame doesn't work when the parent is on a different domain.

If privacy is set to low then this might no be an issue; but since most users would have it set to medium the browser won't let the iFrame to write cookies if that's from a different domain than the parent. To resolve this problem, we need to let the browser allow the cookies from the iFrame site and this can be done with p3p headers.

To do this in a .Net application, we can use the Application_BeginRequest event to set the custom http header to allow p3p.

protected void Application_BeginRequest(object sender, EventArgs e)
{
    HttpContext.Current.Response.AddHeader("p3p", "CP=\"CAO PSA OUR\"");
}

A rather easier way to do this in general, even for classic asp, is to set this in IIS. Go to site properties - HTTP Headers - Add Custom HTTP Header:
Name: p3p
Value: CP="CAO PSA OUR"




Love coding!