A
A
Andrey Pavlenko2015-08-18 19:42:02
JavaScript
Andrey Pavlenko, 2015-08-18 19:42:02

In which domain will cookies be stored?

There is a small question, but there is no way to test it yet, unfortunately.
Let's say we have a site called example.com and it has a test.js file that performs some actions (in particular, it sets cookies).
If we connect it via

<script type="text/javascript" src="http://example.com/test.js"></script>
on another site (example2.com), where will the cookies be written - to the site example.com (after all, the script comes from there) or to example2.com itself (where the file is connected)?
This is important because in the first case, the restriction on 3rd party cookies may work, but I don’t need it at all.
If such a restriction still works, are there methods to get around this, or should I use an iframe?

Answer the question

In order to leave comments, you need to log in

2 answer(s)
V
Vitaly Inchin ☢, 2015-08-18
@Akdmeh

Of course, on example2.com , it's logical.
You have connected a script - a piece of code, a file and a browser, having entered your site, executes it. The fact that the js file is located on a third-party domain does not matter, you just tell the browser that the code needs to be torn out of there, nothing more.
And the restriction will work when you try to request from the script itself to a third-party domain, this is a separate issue.

E
evnuh, 2015-08-18
@evnuh

Andrey Pavlenko : I explain in an accessible way:
the browser builds the page, while loading all the connected resources (css, pictures, fonts, js) that are written on the page. After he has loaded them, he starts rendering the page and executing the js code. All this cooking happens in the context of the URL of the page, that is, on exmaple2.com.
Cookies on example.com in your example can appear only in two cases - when the browser makes a request to example.com to download the js code - it sends the cookies stored on exmaple.com, and in response, along with the js, it may receive cookies from the web server in headers (Set-Cookie:), which will also be set on example.com. And all cookies. which puts js - already on the context domain of the page in which it is executed.

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question