1

In our application,we have an IFrame which is used to display any site (which are set through admin/crm console).We are experiencing a strange issue in showing sites with cookie consent popup in IFrame. In IFrame even if user accepts the Cookies consent,in subsequent requests the popup appears again.It looks like the IFrame is not able to send or set the cookies.

When we open the websites in browser tabs, the popup does not come again once we accept the cookie.What might be happening and how can we get rid of these cookie consent popups once the user accepts it in the IFrame? Please note we don't have control over the sites shown in IFrame.

I tried simple HTML page with IFrame and the issue replicated there,code as follow

<html>
<head>
<title>IFrame issue</title>
</head>
<body>
<iframe src="https://www.nutrition.org.uk/" height="100%" width="100%" title="IFrame Example" ></iframe>
</body>
</html>

Screenshot of popup (Bottom of the page in black color)

enter image description here

Update:-

I checked the cookies set for this website, In normal browser tab when user clicks "OK" button.A new cookie is set e.g. in this case "cookieAcceptanceCookie"="accepted".Check below image,

enter image description here

Same i checked with IFrame and there too same cookie was set.Check below image.

enter image description here

So it looks like the issue remains in sending this cookie in subsequent requests.I guess normal browser tabs can send this cookie where as IFrame is not able to send it,hence this issue is coming in the IFrame.

Amol Kolekar
  • 2,307
  • 5
  • 30
  • 45

1 Answers1

1

This is actually a common privacy feature of browsers, that iframes aren't allowed to set Cookies. It's a protection against CSRF and an anti-tracking feature, because websites for a long time were tracking users via cookies that come from iframes.

You'll probably need to instruct your users to Allow third-party cookies in chrome://settings/content/cookies, possibly creating a page like this one.

If you controlled the sites inside the iframe, you could use SameSite=None ..... but unfortunately that's not applicable because you don't have control of them.

Eliezer Berlin
  • 3,170
  • 1
  • 14
  • 27