IE ignoring cookies when script called from other domain

[gnznroses]

Quick explanation:

I'm tracking conversions for affiliate marketing. So I place a cookie on a user's computer, when they click a link. Then I direct them to an affiliate program. If they buy the product, when they hit the order confirmation page, there will be code like this on that page:

 

<script src="https://domain.com/pixel_123.js"></script>

 

I use mod_rewrite to point the request to

https://domain.com/pixel.php?id=123

 

That script reads the cookie and lets me know that a sale occurred.

 

OK, now here's my problem: this works in Firefox, but for some reason, in IE, it doesn't. I can use a cookie viewer/editor to see that the cookie gets set, and exists at the time that the "pixel" script is triggered, but the script can't see the cookie.

 

Except, that if I place the javascript code on a test page, and upload that to my server ("domain.com"), then it works just fine. So it seems there's some kind of cross-domain problem going on. Meaning that when that javascript is on another website/domain, it's preventing the cookie from being read when it executes on my server. I do know that the script is still executing, but that it simply can't see the cookie.

 

It's worth noting that:

- the script that places the cookie is SSL

- the script that tries to read the cookie is on SSL

- the website that includes the javascript is SSL also

 

i'm setting the cookie like so:

setcookie('thename', 'value_stuff', time()+60*60*24*20, '/', 'domain.com', 1)

i've also tried '.domain.com' as the cookie domain. and i've tried 0 for the secure option.

 

 

I know that this can work, because pixel tracking is very very common, but I can't think of anything else to change...

[gnznroses]

any help appreciated

[PFMaBiSmAd]

If this works in one browser and not another is it likely that the security settings have been adjusted in that one browser to allow third party cookies to work. Check the security settings for "accept third party cookies" in both browsers that you tried.

[gnznroses]

awesome, thanks. you've pointed me in the right direction.

FF doens't have an option like this, but IE does. seems you have to supply a "compact privacy policy" header.

i'm unclear on whether it means the webpage that hosts the tracking code, or in my script that is trying to read the cookie back, but i'll figure it out.