Browser (Chrome) doesn't set HttpOnly cookies from child iframe
I have a parent webpage with a child iframe:
Parent at https://sub1.some-domain.com
Child at <iframe src="https://sub2.some-domain.com"> (inside of parent)
From Parent I do POST request to the API "https://ift.tt/kcwCvjU".
Below is the response Headers:
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://sub1.some-domain.com
Set-Cookie:
payload-name=payload-value;
max-age=30;
domain=some-domain.com;
path=/;
secure;
samesite=none;
httponly
Afterwards,
from the Iframe I do GET request to "https://ift.tt/kcwCvjU".
Expectation: Browser to include Httponly cookies payload-name=payload-value;
into the request.
Result: Httplonly cookies not included for unknown reason.
BTW, I included "withCredentials" property into JS Http request, so this couldn't be a problem.
from Missing HTTPOnly Cookies at HTTP Request from child iFrame
No comments:
Post a Comment