Shibboleth Developers

["Cantor, Scott E." <>]

> Actually, if third party cookies are disabled the iframe itself cannot even
> set a cookie, much less try to access one across the frames.

That's true, but in this case, the writing would be done elsewhere by the IdP 
directly, so it isn't trying to set them.

Of course, some systems like Facebook's are irretrievably broken because the 
whole protocol relies on them. I get a warm fuzzy every time I'm told I can't 
login with Facebook or OpenID because of my completely reasonable browser 
settings.

-- Scott