title: External shop embedded in an iframe uses cookies -- Is is possible if the user blocks third party cookies?
body: <p>Assume you have to integrate a web shop into our own web site using an iframe. The other shop uses cookies and cannot operate if its cookies are blocked.</p>
  
  <p><strong>What if a user blocks 3rd party cookies?</strong></p>
  
  <p>If the user uses Internet Explorer, setting <a href="https://en.wikipedia.org/wiki/P3P" rel="nofollow">P3P Headers</a> can solve the problem. However, P3P is not supported by other major browsers.</p>
  
  <p>So, after some research and experiments, I come to the realization that it is not possible to make it work on all other browsers. (Though I could only test with Firefox and Chrome.)</p>
  
  <p>For my understanding, Mozilla has enforced the third-party cookie settings in a strict sense since 2013: <a href="http://webpolicy.org/2013/02/22/the-new-firefox-cookie-policy/" rel="nofollow">http://webpolicy.org/2013/02/22/the-new-firefox-cookie-policy/</a></p>
  
  <p>Many articles about third-party cookies in iframes were written before 2013. I don't think they are still valid. Some sources claim that you have at least access to existing cookies. According to my experiments, even that is no longer the case.</p>
  
  <p><strong>Are my conclusions correct:</strong></p>
  
  <ul>
  <li>Is it true that it is not longer possible to work around the browser settings?</li>
  <li>In other words, is the recommended solution just to tell the user to allow 3rd-party cookies?</li>
  </ul>
  
  <p>Should I be wrong, I will be glad to hear that. :-)</p>
  
  <p>I have to clarify that it is OK if the solution involves some changes in the web shop that needs to be integrated. So you can assume that the operators of the shops will help you (unless it takes unrealistic time and resources, of course).</p>
  
  <hr>
  
  <p>Side note: I found some possible alternatives, but they are quiet expensive to implement and operate. For example, you could redirect all traffic to the external shop through a proxy server on the same domain (so the cookies become first-party again). Another solution that I read was to replace cookies by local storage but that is easier said than done.</p>
  
  <hr>
  
  <p>If you want to reproduce the problem, here is a minimal example to start with (using www.mercateo.co.uk):</p>
  
  <pre><code>&lt;!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"&gt;
  &lt;html&gt;
  &lt;head&gt;&lt;meta http-equiv="Content-Type" content="text/html; charset=iso-8859-15"&gt;
  &lt;title&gt;&lt;/title&gt;&lt;/head&gt;&lt;body&gt;&lt;h1&gt;&lt;/h1&gt;
  
  &lt;p&gt;Begin iframe&lt;/p&gt;
  
  &lt;iframe width="100%" height="100%" frameborder="0" align="left" scrolling="auto" marginheight="0" marginwidth="0" id="iframe" src="http://www.mercateo.co.uk/basket/view?cookieTest=true" style="height: 586px;"&gt;&lt;/iframe&gt;
  
  &lt;p&gt;End iframe&lt;/p&gt;
  &lt;/body&gt;&lt;/html&gt;
  </code></pre>
  
  <p>If third-party cookies are blocked, it will redirect you to an error page showing "Your browser does not accept cookies". Tested on Chrome and Firefox.</p>