跨域复制 cookie，为什么 IE 会阻止其他浏览器使用 SCRIPT 标签发送的 cookie
尝试将 cookie 从 Second.com 复制到 First.com，并完全控制这两个域。
以前使用了 iFrame，但这无法在所有浏览器上工作，因为它涉及“第三方 cookie”，而这在 Safari 和 Chrome 中很难实现且不可能。
新方法使用指向 secondary.com 的 SCRIPT 标记，并包含在first.com 的 HEAD 中。服务器端脚本实际上是一段 Java，它读取随请求发送的 cookie（来自 secondary.com 的 cookie），返回的 JavaScript 在first.com 上执行，并且本质上复制了此处的 cookie。这在除 IE 之外的所有浏览器中都运行良好，其中 IE 似乎不会通过 SCRIPT 请求发送 secondary.com cookie，因此 Java 无法从 secondary.com 获取 cookie 值。
这肯定与 IE 安全设置有关，因为当我将隐私设置为最低级别时，它会起作用，但我的问题是为什么 cookie 被阻止了？我认为 SCRIPT 标签不受同源策略的约束（AJAX 和其他技术必须遵守）。
有没有办法解决这个问题而不走 P3P 隐私政策路线？
Trying to copy a cookie from second.com to first.com, with full control of both domains.
Previously an iFrame was used, however this is not able to work across all browsers as it touched on 'third-party cookies' which are hard to implement and impossible in Safari and Chrome.
The new approach uses a SCRIPT tag pointing to second.com and included in the HEAD of first.com. The server-side script is actually a piece of Java which reads the cookies sent with the request (the cookies from second.com) and the JavaScript returned executes on first.com and essentially duplicates the cookie here. This is working great in all browsers except IE, where IE appears to not be sending the second.com cookies with SCRIPT request, so the Java is not able to pickup the cookie value from second.com.
This is surely to do with IE security settings as when I put privacy to the lowest level it is working, but my question is why are the cookies being blocked at all? I thought the SCRIPT tag was not subject to the same origin policy (that AJAX and other technologies have to comply with).
Any solution to this without heading down the P3P privacy policy route?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
这绝对是 IE 安全设置，如果您尝试执行此操作，则需要在页面上设置 P3P 紧凑隐私策略，以便在first.com 上设置 cookie，甚至在您到达 secondary.com 之前
It's definitely IE security settings, if you're attempting this you'll need to set a P3P compact privacy policy on the page which sets the cookie on first.com, even before you've reached second.com