Safari 3rd party cookie iframe trick no longer working?

by

Just wanted to leave a simple working solution here that does not require user interaction.

As I stated in a post I made:

Basically all you need to do is load your page on top.location, create the session and redirect it back to facebook.

Add this code in the top of your index.php and set $page_url to your application final tab/app URL and you’ll see your application will work without any problem.

<?php
    // START SAFARI SESSION FIX
    session_start();
    $page_url = "http://www.facebook.com/pages/.../...?sk=app_...";
    if (isset($_GET["start_session"]))
        die(header("Location:" . $page_url));

    if (!isset($_GET["sid"]))
        die(header("Location:?sid=" . session_id()));
    $sid = session_id();
    if (empty($sid) || $_GET["sid"] != $sid):
?>
   <script>
        top.window.location="?start_session=true";
    </script>
<?php
    endif;
    // END SAFARI SESSION FIX
?>

Note: This was made for facebook, but it would actually work within any other similar situations.

Edit 20-Dec-2012 – Maintaining Signed Request:

The above code does not maintain the requests post data, and you would loose the signed_request, if your application relies on signed request feel free to try the following code:

Note: This is still being tested properly and may be less stable than the first version.
Use at your own risk / Feedback is appreciated.

(Thanks to CBroe for pointing me into the right direction here allowing to improve the solution)

// Start Session Fix
session_start();
$page_url = "http://www.facebook.com/pages/.../...?sk=app_...";
if (isset($_GET["start_session"]))
    die(header("Location:" . $page_url));
$sid = session_id();
if (!isset($_GET["sid"]))
{
    if(isset($_POST["signed_request"]))
       $_SESSION["signed_request"] = $_POST["signed_request"];
    die(header("Location:?sid=" . $sid));
}
if (empty($sid) || $_GET["sid"] != $sid)
    die('<script>top.window.location="?start_session=true";</script>');
// End Session Fix

More Related Contents:

  1. How to identify if a webpage is being loaded inside an iframe or directly into the browser window?
  2. Invoking JavaScript code in an iframe from the parent page
  3. Pass value to iframe from a window
  4. How to embed an autoplaying YouTube video in an iframe?
  5. “Access is denied” JavaScript error when trying to access the document object of a programmatically-created (IE-only)
  6. Unsafe JavaScript attempt to access frame with URL
  7. Date parsing in javascript is different between safari and chrome
  8. Mobile Safari back button [duplicate]
  9. Setting focus to iframe contents
  10. How to change style of iframe content cross-domain?
  11. Set content of iframe
  12. putting html inside an iframe (using javascript)
  13. How can I access the DOM elements within an iFrame
  14. how to block website from loading in iframe?
  15. Is it possible to add a link to download a file that can only be downloaded by sharing it on Facebook?
  16. Can I apply CSS to the elements within an iframe?
  17. javascript large integer round because precision? (why?)
  18. Is it possible to add Request Headers to an iframe src request?
  19. Is there a way to uniquely identify an iframe that the content script runs in for my Chrome extension?
  20. Is there a way to enable the JavaScript Error/Debug Console for Safari within Android?
  21. Check if parent window is iframe or not
  22. Accessing an element outside of iframe
  23. iFrame onload JavaScript event
  24. Eliminate 300ms delay on click events in mobile Safari
  25. Impossible to hide navigation bars in Safari iOS 7 for iPhone/iPod touch
  26. Trigger a button click inside an iframe [duplicate]
  27. Accessing iframe from chrome extension
  28. Google DFP – Resize SafeFrame custom creative outer Iframe container from inside (expand ad)
  29. Youtube embed: Unsafe JavaScript attempt to access frame
  30. onclick=”location.href=’link.html'” does not load page in Safari

Leave a Comment