Iframe, cross-domain cookies, p3p policy, and safari with error: A required anti-forgery token was not supplied or was invalid

Question

I asked this question a while back and found that IE blocks cross-domain cookies in an iframe unless you set a p3p policy. So far, the p3p fix has worked beautifully in ie. However, now we are getting the same error in safari.

I found an article with a different p3p policy for safari. I added this code to set up the p3p policy, but I am still getting a request verification token error.

public static void SetP3PCompactPolicy()
{
    HttpContext current = HttpContext.Current;

    if (current.Request.UserAgent.ToLower().IndexOf("safari") >= 0)
        HttpContext.Current.Response.AddHeader("p3p", "CP=\"IDC DSP COR CURa ADMa OUR IND PHY ONL COM STA\"");
    else
        HttpContext.Current.Response.AddHeader("p3p", "CP=\"IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT\"");
}

I'm not sure what any of that means, but it isn't working for Safari (5).

Also, when I get a server error, all information is sent to me in a report, including all the http headers. The p3p header never comes through in these errors. I'm not sure if that is by design or if it is an indicator of the issue going on.

Sadducee

Answer 1

The issue is that Safari does not allow a cookie to be set in an iframe unless the user interacts with that iframe. For some, that means clicking a link. I found a better solution which is to do a redirect.

First, I put this form on my page. Actually, I put it in the masterpage that is used by every view served in the iframe.

<% if(SecurityHelper.BrowserIsSafari) { %>
    <% using (Html.BeginForm("SafariRedirect", "Framed", FormMethod.Post, new { id="safari-fix-form" })) { %>
       <%: Html.Hidden("safariRedirectUrl")%>
    <% } %>
<% } %>

Because I only want this to work when the user is using safari, I created this property in a static helper class to check the useragent

public static bool BrowserIsSafari
{
    get { return HttpContext.Current.Request.UserAgent.ToLower().IndexOf("safari") >= 0; }
}

Then, in my controller, I have the following action

[HttpPost]
public ActionResult SafariRedirect(string safariRedirectUrl)
{
    Response.Cookies.Add(new HttpCookie("safari_cookie_fix", "cookie ok"));

    return Redirect(safariRedirectUrl);
}

In my masterpage, in the header, I have my script declared within the same if statement that determines if the form is rendered. In my script file, I have this jquery

$(function () {

    if ($.browser.safari == true && document.cookie.indexOf("safari_cookie_fix") == -1) {
        var url = location.href;

        $('#safariRedirectUrl').val(url);
        $('#safari-fix-form').submit();
    }

});

The first time the iframe loads a page, if it is safari and the cookie isn't set, the form is posted, the cookie set, and the user is redirected back to the same url.

Sadducee

I have very similar issue (#6126241) so if this helps me feel free add your comment and I'll give you bounty. – Teresiateresina

hm I added form and Action with cookies and my safari down in recursion. document.cookie.indexOf("safari_cookie_fix") always empty. But under developer tools I see "cookie ok" – Teresiateresina

I am fairly certain the above approach worked for me in Safari 4.5. I ended up dumping the cookies though, because security settings in IE can also block third party cookies. – Sadducee

I am under safari 5.1.4. and for some reasons my cookies are empty... For IE I added p3p header and it works – Teresiateresina

ok, I added to my server method that get curent cookies and return JSONP result (true || false). and using this result instead document.cookies. looks like work. So I recon you add this link to my issue (#6126241) and I'll mark it as answer and add bounty ;) – Teresiateresina

Just a note, usally Chrome also has the string "safari" in its user-agent, so the BrowserIsSafari might need to be re-done... – Truesdale

Unfortunately, this loophole appears to have been closed. See #9931171 for more discussion. – Sanctimony