A large number of users do not send set cookies

Question

PHP

I am writing a script for displaying an advertising banner on the webmaster's website. The process of displaying the banner goes something like this:

- a script is requested from my site that creates a frame at the address /place.php?param=value ... of my site
- the server creates a cookie with a unique name and hangs them up to the user in response to the request + returns the frame
code - code frame collects the data I need and executes an ajax get request to the /place.php address (always without parameters - the data is sent in custom headers of the X-Name-Value type, the name of the attached cookie is also transmitted)
- the server receives this request and tries to read the cookie by the given name.

This is where the problem arises. For a large number of users (about 12%), the server, when receiving an ajax get request, does not see any cookies at all. Tobezh not only does not see the cookie by the given name, but the $_COOKIE array is also empty. At the same time, everything works fine for other users.

I just can't believe that 12% of users have cookies turned off - so the problem is something else. In what? Help me please. The code was tested on a site with 12k unique visitors per day. Nearly one and a half thousand users have identified the described problem. User agents were not logged (alas, I'll start right away), but there are ip addresses.

Answer 1

We went through this rake :)
Most likely there are problems with two browsers: Safari and IE.
For IE, there is a spell that needs to be sent to the header. Here it is:
Headers.Add("P3P", "CP=\"IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT\"")
But safari has paranoid mode by default: do not take cookies from third parties sites. Even Google struggled with this and found a cure, and then received a lawsuit from Apple :)
The essence of the cure is to emulate user input in your frame, then Safari considers your site friendly.

Answer 2

Could this be the result of some popular banner cutter?

Answer 3

Sorry, here is the link with the anchor

Answer 4

So far, there is one guess. Perhaps not all browsers correctly set cookies if you do not specify all the parameters in the setcookie function.

Answer 5

Recently I ran into a problem in Chrome - either not accepting, or not setting (I don’t remember) a cookie on another URI higher in level, within the same domain, but not in the root. Those. I'm on "/example/com", I put the cookie on "/example", but it wasn't there. And in "/" everything is perfectly set and read.
Perhaps your Chromists just spoil the statistics. Follow the urls.

Answer 6

To be honest, there was no time to figure out whether this is a bug or a feature, but it rather smacks of excessive "security" in Chrome. There is nothing they say to put where it is not supposed to.
Yes, and it seems to be logical: it is difficult for a child to influence a parent (a subsection on the parent). With regards to the subject, I became interested in the problem (the same is expected in the near future), 10 seconds of googling and Habr
closed the circle , but the problem has not been fully resolved. The first thought - to install through js - caused a grin from the documentation. So an iframe with a form with autosubmit is our option.