Sunday, 23 July 2023

Missing HTTPOnly Cookies at HTTP Request from child iFrame

Browser (Chrome) doesn't set HttpOnly cookies from child iframe

I have a parent webpage with a child iframe:

Parent at https://sub1.some-domain.com
Child at <iframe src="https://sub2.some-domain.com"> (inside of parent)

From Parent I do POST request to the API "https://ift.tt/kcwCvjU".
Below is the response Headers:

Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://sub1.some-domain.com
Set-Cookie:
 payload-name=payload-value;
 max-age=30;
 domain=some-domain.com;
 path=/;
 secure;
 samesite=none;
 httponly
    

Afterwards,
from the Iframe I do GET request to "https://ift.tt/kcwCvjU".
Expectation: Browser to include Httponly cookies payload-name=payload-value; into the request.

Result: Httplonly cookies not included for unknown reason.
BTW, I included "withCredentials" property into JS Http request, so this couldn't be a problem.



from Missing HTTPOnly Cookies at HTTP Request from child iFrame

No comments:

Post a Comment