Using iframes to present contribution page on remote site
After a lot of desperate digging we have come up with a work-around. I think the right answer is: Don't use iframes. There seems to be thoughtful reasons to restrict the flow of cookies/session information between an iframe and the parent and even though we have figured out a way to work-around it now, I'm not confident these tricks will work in the future.

Having said that...

For Internet Explorer, we got it to work by sending a header declaring our P3P policy. We used the following in settings.php (I'm sure you could put it in civicrm.settings.php too):

header('P3P:CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"');


That seemed to placate IE (note: you should really lookup what these codes mean before blindly putting this into place - each one of these codes has meaning - more information on meaning is available here).

Safari was much harder. We had to add the javascript provided on a helpful blog post to get things working. It's a crappy solution - since it essentially redirects the user to the CiviCRM page and then back to the iframed page - which is confusing for the user and delays the loading of the page.

Here's the code I added to the Drupal theme's template.php file:

function tceiframe_preprocess_html(&amp;$variables) {
  // Call our parent to do most of the work.
  newsflash_preprocess_html($variables);
  $path = drupal_get_path('theme', 'tceiframe');
  drupal_add_js($path . '/safari.iframe.fix.js');
}


And here is the javascript:

window.onload=function(){
 if(navigator.userAgent.indexOf('Safari')!=-1&amp;&amp;navigator.userAgent.indexOf('Chrome')==-1){
  var cookies=document.cookie;

  if(top.location!=document.location){
   if(!cookies){
    href=document.location.href;
    href=(href.indexOf('?')==-1)?href+'?':href+'&amp;';
    top.location.href =href+'reref='+encodeURIComponent(document.referrer);
   }
  } else {

   ts=new Date().getTime();document.cookie='ts='+ts;
   rerefidx=document.location.href.indexOf('reref=');
   if(rerefidx!=-1){
    href=decodeURIComponent(document.location.href.substr(rerefidx+6));
    window.location.replace(href);
   }
  }
 }
}