p3p, cookie

iframe跨域session丟失問題
Session variables are lost if you use FRAMESET in Internet Explorer 6
Privacy in Internet Explorer 6

在abc.com 的網域下, 嵌了一個 def.com 的 iframe, abc 下的 cookie, def 讀不到合情合理, 但是會發現我在def.com 下 想寫一個在def.com domain 下的cookie 在ie也會有問題, 這是因為ie privacy policy 的原因

reference:
IE6/IE7支持的P3P(Platform for Privacy Preferences Project (P3P) specification)協議默認阻止第三方無隱私安全聲明的cookie，Firefox目前還不支持P3P安全特性，firefox中自然也不存在此問題了。Mircosoft對此的具體描述可以參見 Privacy in Internet Explorer 6


p3p不能讓其他域讀取到第三方域的cookie
只是使 第三方cookie在能夠在本域內被存取
比如一個 www.cctv.com中有個服務應用 是 cnc.com域的，
通常情況下用戶的隱私策略設置為中或者更高 在cnc.com域的cookie是不能夠正常讀取的，服務端能夠改變 用戶對cnc.com域的隱私策略使cnc.com域下的cookie正常存取

example
<br />#This code sample shows that your site provides you access to your own contact information (CAO), that any analyzed data is only "pseudo-analyzed", which means that the data is connected to your online persona and not to your physical identity (PSA), and that your data is not supplied to any outside agencies for those agencies to use (OUR).<br /><br />#介紹, 因為cookie 沒法跨網域, 只好在其他地方登入傳cookie過來, 可是光傳過來還是不能寫, 所以要設定p3p<br /> def set_ourcompany_cookie<br /> response.headers['P3P'] = 'CP=CAO PSA OUR'<br /><br /> cookies[:icetech] = {<br /> :value => params[:p],<br /> :http_only => true,<br /> :domain => 'ourcompany.com.tw',<br /> :expires => USER_COOKIE_EXPIRATION.from_now<br /> }<br /><br /> cookies.delete :user<br /> cookies[:user] = {<br /> :value =>'',<br /> :http_only => true,<br /> :domain => cookie_domain,<br /> :expires => Time.at(0)<br /> }<br /><br /> redirect_to :action => params[:company]<br /> end<br />