Shibboleth Developers

["Cantor, Scott E." <>]

> I'm not sure what definition is being used for 3rd party cookies, but 
> cookies
> need to be read through an iframe.  They are never written through an
> iframe.  I'm curious though, what issues are seen with this?

It's a cookie associated with a domain other than the one from which the 
original page came. I'm pretty sure that's the only definition.

AFAIK, reading cookies through an IFRAME is not allowed across domains when 
third party cookies are disabled.

People often fool themselves into thinking this works, because many browsers 
treat domains with a common tail as a special case, and allow reading them 
even when they're disabled. Using completely separate domains (which I think 
you'll agree is the entire basis of your proposal) results in different 
behavior.

-- Scott