宫墨修音 2024-12-23 17:35:49

我让它工作了，但解决方案有点复杂，所以请耐心等待。

发生的情况

事实上，Internet Explorer 对 IFRAME 页面的信任级别较低（IE 将此称为“第三方”内容）。如果 IFRAME 内的页面没有隐私政策，则其 cookie 会被阻止（由状态栏中的眼睛图标表示，当您单击它时，它会显示被阻止的 URL 列表）。

_{（来源：piskvor.org）}

在这种情况下，当cookie被阻止，会话标识符未发送，并且目标脚本抛出“未找到会话”错误。

（我尝试将会话标识符设置到表单中并从 POST 变量加载它。这会起作用，但出于政治原因我不能这样做。）

可以使页面IFRAME 内部更受信任：如果内部页面发送带有 IE 可接受的隐私策略的 P3P 标头，则 cookie 将被接受。

如何解决该问题

创建 p3p 策略

W3C 教程是一个很好的起点。我已经完成了它，下载了 IBM Privacy Policy Editor 并在那里创建了一个表示的隐私政策，并为其指定一个名称以供引用（此处为 policy1）。

注意：此时，您实际上需要查明您的网站是否有隐私政策，如果没有，请创建它 - 它是否收集用户数据、什么类型的数据、它如何处理这些数据、谁有权访问它等等。您需要找到此信息并思考。 仅仅将几个标签放在一起是不够的。这一步不能纯粹用软件来完成，并且可能具有高度政治性（例如“我们应该出售我们的点击统计数据吗？”）。

（例如“该网站由 ACME Ltd. 运营，其运营使用匿名的每会话标识符，仅在明确许可的情况下收集用户数据，并且仅用于以下目的，仅在必要时存储数据，仅我们公司可以访问它，等等”）。

（使用此工具进行编辑时，可以查看策略中的错误/遗漏。“HTML 策略”选项卡也非常有用：在底部，它有一个“策略评估” - 快速检查策略是否会被阻止根据 IE 的默认设置）

编辑器导出到 .p3p 文件，该文件是上述策略的 XML 表示形式。此外，它还可以导出该策略的“精简版本”。

政策链接

然后需要一个政策参考文件 (http://example.com/w3c/p3p.xml)（网站使用的隐私政策索引）：

<META>
  <POLICY-REFERENCES>
    <POLICY-REF about="/w3c/example-com.p3p#policy1">
      <INCLUDE>/</INCLUDE>
      <COOKIE-INCLUDE/>
    </POLICY-REF>
  </POLICY-REFERENCES>
</META>

< INCLUDE> 显示将使用此策略的所有 URI（在我的例子中是整个网站）。我从编辑器导出的策略文件已上传到 http://example.com/w3c/example-com.p3p

发送带有响应的紧凑标头，

我已在示例中设置了网络服务器。 com 发送带有响应的紧凑标头，如下所示：

HTTP/1.1 200 OK 
P3P: policyref="/w3c/p3p.xml", CP="IDC DSP COR IVAi IVDi OUR TST"
// ... other headers and content

policyref 是策略参考文件（依次引用隐私策略）的相对 URI，CP 是紧凑标头政策代表性。 请注意，示例中的 P3P 标头组合可能不适用于您的特定网站；您的 P3P 标头必须如实代表您自己的隐私政策！

利润！

在此配置中，邪眼不会出现，cookie 甚至会保存在 IFRAME 中，并且应用程序可以正常运行。

编辑：不应该做什么，除非你想免受诉讼

有几个人建议“在你的 P3P 标头中打上一些标签，直到邪恶之眼放弃”。

这些标签不仅仅是一堆位，它们具有现实世界的含义，并且它们的使用赋予您现实世界的责任！

例如，假装你从不收集用户数据可能会让浏览器满意，但如果你真的收集用户数据，P3P 就与现实相冲突了。简单明了，您是故意对用户撒谎，这在某些国家/地区可能属于犯罪行为。就像“进监狱，不要收取 200 美元”。

一些示例（请参阅 p3pwriter 了解完整的标签集）：

NOI：“网站不收集识别数据。” （一旦有任何定制、登录或任何数据收集（***** 分析，任何人？），您必须在 P3P 中确认它）
STP ：保留信息以实现既定目的。这需要尽早丢弃信息。站点必须制定保留策略来制定销毁时间表。保留政策必须包含在网站可读的隐私政策中或与之链接。”（因此，如果您发送 STP 但没有保留政策，您可能完全不是。）

我不是律师，但我不愿意上法庭看看 P3P 标头是否真正具有法律约束力。你可以向你的用户承诺任何事情，但实际上却不愿意兑现你的承诺。

I got it to work, but the solution is a bit complex, so bear with me.

What's happening

As it is, Internet Explorer gives lower level of trust to IFRAME pages (IE calls this "third-party" content). If the page inside the IFRAME doesn't have a Privacy Policy, its cookies are blocked (which is indicated by the eye icon in status bar, when you click on it, it shows you a list of blocked URLs).

_{(source: piskvor.org)}

In this case, when cookies are blocked, session identifier is not sent, and the target script throws a 'session not found' error.

(I've tried setting the session identifier into the form and loading it from POST variables. This would have worked, but for political reasons I couldn't do that.)

It is possible to make the page inside the IFRAME more trusted: if the inner page sends a P3P header with a privacy policy that is acceptable to IE, the cookies will be accepted.

How to solve it

Create a p3p policy

A good starting point is the W3C tutorial. I've gone through it, downloaded the IBM Privacy Policy Editor and there I created a representation of the privacy policy and gave it a name to reference it by (here it was policy1).

NOTE: at this point, you actually need to find out if your site has a privacy policy, and if not, create it - whether it collects user data, what kind of data, what it does with it, who has access to it, etc. You need to find this information and think about it. Just slapping together a few tags will not cut it. This step cannot be done purely in software, and may be highly political (e.g. "should we sell our click statistics?").

(e.g. "the site is operated by ACME Ltd., it uses anonymous per-session identifiers for its operation, collects user data only if explicitly permitted and only for the following purposes, the data is stored only as long as necessary, only our company has access to it, etc. etc.").

(When editing with this tool, it's possible to view errors/omissions in the policy. Also very useful is the tab "HTML Policy": at the bottom, it has a "Policy Evaluation" - a quick check if the policy will be blocked by IE's default settings)

The Editor exports to a .p3p file, which is an XML representation of the above policy. Also, it can export a "compact version" of this policy.

Link to the policy

Then a Policy Reference file (http://example.com/w3c/p3p.xml) was needed (an index of privacy policies the site uses):

<META>
  <POLICY-REFERENCES>
    <POLICY-REF about="/w3c/example-com.p3p#policy1">
      <INCLUDE>/</INCLUDE>
      <COOKIE-INCLUDE/>
    </POLICY-REF>
  </POLICY-REFERENCES>
</META>

The <INCLUDE> shows all URIs that will use this policy (in my case, the whole site). The policy file I've exported from the Editor was uploaded to http://example.com/w3c/example-com.p3p

Send the compact header with responses

I've set the webserver at example.com to send the compact header with responses, like this:

HTTP/1.1 200 OK 
P3P: policyref="/w3c/p3p.xml", CP="IDC DSP COR IVAi IVDi OUR TST"
// ... other headers and content

policyref is a relative URI to the Policy Reference file (which in turn references the privacy policies), CP is the compact policy representation. Note that the combination of P3P headers in the example may not be applicable on your specific website; your P3P headers MUST truthfully represent your own privacy policy!

Profit!

In this configuration, the Evil Eye does not appear, the cookies are saved even in the IFRAME, and the application works.

Edit: What NOT to do, unless you like defending from lawsuits

Several people have suggested "just slap some tags into your P3P header, until the Evil Eye gives up".

The tags are not only a bunch of bits, they have real world meanings, and their use gives you real world responsibilities!

For example, pretending that you never collect user data might make the browser happy, but if you actually collect user data, the P3P is conflicting with reality. Plain and simple, you are purposefully lying to your users, and that might be criminal behavior in some countries. As in, "go to jail, do not collect $200".

A few examples (see p3pwriter for the full set of tags):

NOI : "Web Site does not collected identified data." (as soon as there's any customization, a login, or any data collection (***** Analytics, anyone?), you must acknowledge it in your P3P)
STP: Information is retained to meet the stated purpose. This requires information to be discarded at the earliest time possible. Sites MUST have a retention policy that establishes a destruction time table. The retention policy MUST be included in or linked from the site's human-readable privacy policy." (so if you send STP but don't have a retention policy, you may be committing fraud. How cool is that? Not at all.)

I'm not a lawyer, but I'm not willing to go to court to see if the P3P header is really legally binding or if you can promise your users anything without actually willing to honor your promises.

回复收藏 0 原文

美人骨 2024-12-23 17:35:49

我花了一天的大部分时间研究 P3P 的事情，我觉得有必要分享我的发现。

我注意到 P3P 概念非常过时，并且似乎只有 Internet Explorer (IE) 才真正使用/强制执行。

最简单的解释是：如果您使用cookie，IE 希望您定义一个P3P 标头。

这是一个好主意，幸运的是大多数时候不提供此标头不会导致任何问题（请阅读浏览器警告）。除非您的网站/网络应用程序使用 (i)Frame 加载到其他网站中。这就是 IE 成为一个巨大痛苦的地方。除非设置了 P3P 标头，否则它不允许您设置 cookie。

知道这一点后，我想找到以下两个问题的答案：

谁在乎？换句话说，如果我在标题中添加“Potato”一词，我会被起诉吗？
其他公司是做什么的？

我的发现是：

没有人关心。我找不到任何文件表明这项技术具有任何法律效力。在我的研究过程中，我没有发现世界上有任何一个国家通过了一项法律，禁止您在 P3P 标头中添加“Potato”一词
Google 和 Facebook 都在其 P3P 标头字段中放置了一个链接，该链接引用了描述的页面为什么他们没有 P3P 标头。

这个概念诞生于 2002 年，令我困惑的是，这个过时且未在法律上实施的概念仍然强加给 IE 中的开发人员。
如果此标头没有任何法律后果，则应忽略此标头（或者在控制台中生成警告或通知）。不强制执行！我现在被迫在代码中添加一行（并向客户端发送标头），该行绝对不执行任何操作。

简而言之 - 为了让 IE 满意 - 将以下行添加到您的 PHP 代码中（其他语言应该看起来类似）

header('P3P: CP="Potato"');

问题解决了，IE 对这个土豆感到满意。

I've spend a large part of my day looking into this P3P thing and I feel the need to share what I've found out.

I've noticed that the P3P concept is very outdated and seems only to be really used/enforced by Internet Explorer (IE).

The simplest explanation is: IE wants you to define a P3P header if you are using cookies.

This is a nice idea, and luckily most of the time not providing this header won't cause any issues (read browser warnings). Unless your website/web application is loaded into an other website using an (i)Frame. This is where IE becomes a massive pain in the ***. It will not allow you to set a cookie unless the P3P header is set.

Knowing this I wanted to find an answer to the following two questions:

Who cares? In other words, can I be sued if I put the word "Potato" in the header?
What do other companies do?

My findings are:

No one cares. I'm unable to find a single document that suggests this technology has any legal weight. During my research I didn't find a single country around the world that has adopted a law that prevents you from putting the word "Potato" in the P3P header
Both Google and Facebook put a link in their P3P header field referring to a page describing why they don't have a P3P header.

The concept was born in 2002 and it baffles me that this outdated and legally unimplemented concept is still forced upon developers within IE.
If this header doesn't have have any legal ramifications this header should be ignored (or alternatively, generate a warning or notification in the console). Not enforced! I'm now forced to put a line in my code (and send a header to the client) that does absolutely nothing.

In short - to keep IE happy - add the following line to your PHP code (Other languages should look similar)

header('P3P: CP="Potato"');

Problem solved, and IE is happy with this potato.

回复收藏 0 原文

手心的温暖 2024-12-23 17:35:49

我只需将这个小标头添加到 IFrame（PHP 解决方案）中的网站即可消除邪恶之眼：

header('P3P: CP="NOI ADM DEV COM NAV OUR STP"');

记住按 ctrl+F5 重新加载您的网站，否则资源管理器可能仍会显示邪恶之眼，尽管事实上它运行良好。这可能是我在使用它时遇到很多问题的主要原因。

根本不需要政策文件。

编辑：
我发现了一篇不错的博客文章，它解释了 IFrame 中 cookie 的问题。它还在 C# 代码中提供了快速修复：
框架、ASPX 页面和拒绝的 Cookie

I was able to make the evil eye go away by simply adding this small header to the site in the IFrame (PHP solution):

header('P3P: CP="NOI ADM DEV COM NAV OUR STP"');

Remember to press ctrl+F5 to reload your site or Explorer may still show the evil eye, despite the fact that it's working fine. This is probably the main reason why I had so many problems getting it to work.

No policy file was neccesary at all.

Edit:
I found a nice blog entry that explains the problem with cookies in IFrames. It also has a quick fix in C# code:
Frames, ASPX Pages and Rejected Cookies

回复收藏 0 原文

小傻瓜 2024-12-23 17:35:49

这被埋在其他答案的评论中，但我几乎错过了它，所以看起来它应该有自己的答案。

回顾一下：为了让 IE 接受第 3 方 cookie，您需要使用名为 p3p 的 http 标头来提供文件，其格式为：

CP="my compact p3p policy"

但是，p3p 作为标准此时几乎已经死亡，您可以轻松地让 IE 工作而无需投入时间和法律资源来制定真正的 P3P 政策。这是因为，如果您的紧凑 p3p 策略标头无效，IE 实际上会将其视为良好策略并接受第 3 方 cookie。因此，您可以使用像这样的 p3p 标头

CP="This site does not have a p3p policy."

您可以选择包含一个指向页面的链接，该链接解释了为什么您没有 p3p 政策，就像 Google 和 Facebook 所做的那样（他们在这里指出：https://support.google.com/accounts/answer/151657 和此处：https://www.facebook.com/help/327993273962160/）。

最后，需要注意的是，从第 3 方站点提供的所有文件都需要具有 p3p 标头，而不仅仅是设置 cookie 的标头，因此您可能无法仅在 PHP、asp.net 等中执行此操作代码。您最好在 Web 服务器级别（即在 IIS 或 Apache 中）进行设置。

This is buried in the comments of other answers, but I almost missed it, so it seems like it deserves its own answer.

To review: in order for IE to accept 3rd party cookies, you need serve your files with an http header called p3p in the format:

CP="my compact p3p policy"

BUT, p3p is pretty much dead as a standard at this point and you can easily get IE to work without investing the time and legal resources in creating a real p3p policy. This is because if your compact p3p policy header is invalid, IE actually treats it as a good policy and accepts 3rd party cookies. So you can use a p3p header such as this

CP="This site does not have a p3p policy."

You can optionally include a link to a page that explains why you don't have a p3p policy, as Google and Facebook do (they point here: https://support.google.com/accounts/answer/151657 and here: https://www.facebook.com/help/327993273962160/).

Finally, it's important to note that all files served from the 3rd party site need to have the p3p header, not just the one that sets the cookie, so you may not be able to just do this in your PHP, asp.net, etc code. You are probably better off setting in up on the web server level (i.e. in IIS or Apache).

回复收藏 0 原文

几味少女 2024-12-23 17:35:49

我也遇到了这个问题，我想我应该发布我在 MVC2 项目中使用的代码。在页面生命周期中添加标头时要小心，否则您将收到 HttpException“服务器无法在发送 HTTP 标头后附加标头”。我在 OnActionExecuting 方法（在执行操作之前调用）上使用了自定义 ActionFilterAttribute。

/// <summary>
/// Privacy Preferences Project (P3P) serve a compact policy (a "p3p" HTTP header) for all requests
/// P3P provides a standard way for Web sites to communicate about their practices around the collection, 
/// use, and distribution of personal information. It's a machine-readable privacy policy that can be 
/// automatically fetched and viewed by users, and it can be tailored to fit your company's specific policies.
/// </summary>
/// <remarks>
/// More info http://www.oreillynet.com/lpt/a/1554
/// </remarks>
public class P3PAttribute : ActionFilterAttribute
{
    /// <summary>
    /// On Action Executing add a compact policy "p3p" HTTP header
    /// </summary>
    /// <param name="filterContext"></param>
    public override void OnActionExecuting(ActionExecutingContext filterContext)
    {
        HttpContext.Current.Response.AddHeader("p3p","CP=\"IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT\"");

        base.OnActionExecuting(filterContext);
    }
}

使用示例：

[P3P]
public class HomeController : Controller
{
    public ActionResult Index()
    {
        ViewData["Message"] = "Welcome!";

        return View();
    }

    public ActionResult About()
    {
        return View();
    }
}

I had this issue as well, thought I'd post the code that I used in my MVC2 project. Be careful when in the page life cycle you add in the header or you'll get an HttpException "Server cannot append header after HTTP headers have been sent." I used a custom ActionFilterAttribute on the OnActionExecuting method (called before the action is executed).

/// <summary>
/// Privacy Preferences Project (P3P) serve a compact policy (a "p3p" HTTP header) for all requests
/// P3P provides a standard way for Web sites to communicate about their practices around the collection, 
/// use, and distribution of personal information. It's a machine-readable privacy policy that can be 
/// automatically fetched and viewed by users, and it can be tailored to fit your company's specific policies.
/// </summary>
/// <remarks>
/// More info http://www.oreillynet.com/lpt/a/1554
/// </remarks>
public class P3PAttribute : ActionFilterAttribute
{
    /// <summary>
    /// On Action Executing add a compact policy "p3p" HTTP header
    /// </summary>
    /// <param name="filterContext"></param>
    public override void OnActionExecuting(ActionExecutingContext filterContext)
    {
        HttpContext.Current.Response.AddHeader("p3p","CP=\"IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT\"");

        base.OnActionExecuting(filterContext);
    }
}

Example use:

[P3P]
public class HomeController : Controller
{
    public ActionResult Index()
    {
        ViewData["Message"] = "Welcome!";

        return View();
    }

    public ActionResult About()
    {
        return View();
    }
}

回复收藏 0 原文

苯莒 2024-12-23 17:35:49

这是关于这个问题的一个很好的话题，但是我发现一个重要的细节（至少在我的情况下是必不可少的）没有发布在这里或其他任何地方（如果我错过了，我很抱歉）是 P3P 线路必须是传入从第 3 方服务器发送的每个文件的标头，甚至是未设置或使用 cookie 的文件，例如 Javascript 文件或图像。否则 cookie 将被阻止。我在此处的帖子中有更多相关信息：http://posheika.net/?p=110

回复收藏 0 原文

囚你心 2024-12-23 17:35:49

任何在 Node.js 中遇到此问题的人。

然后添加这个p3p模块，并在中间件中启用这个模块。

npm install p3p

我使用的是express，所以我将其添加到app.js中

首先需要app.js中的模块

var express = require('express');
var app = express();
var p3p = require('p3p');

，然后将其用作中间件

app.use(p3p(p3p.recommended));

它将在res对象中添加p3p标头。无需做任何额外的事情。

您将在以下位置获得更多信息：

https://github.com/troygoode/node-p3p

Anyone having this problem in node.js.

Then add this p3p module, and enable this module at middleware.

npm install p3p

I am using express so I add it in app.js

First require that module in app.js

var express = require('express');
var app = express();
var p3p = require('p3p');

then use it as middleware

app.use(p3p(p3p.recommended));

It will add p3p headers at res object. No need to do any extra things.

You will get more info at:

https://github.com/troygoode/node-p3p

回复收藏 0 原文

我也只是我 2024-12-23 17:35:49

如果有人正在寻找 Apache 线路；我们用的是这个。

标头设置 P3P "CP=\"感谢 IE8\""

只要有 P3P 标头，我们将 CP 值设置为多少并不重要。

回复收藏 0 原文

手长情犹 2024-12-23 17:35:49

一种可能的做法是将域添加到工具中允许的站点 ->互联网选项 ->隐私->站点：somedomain.com ->允许->好的。

回复收藏 0 原文

拥有 2024-12-23 17:35:49

这篇文章提供了一些关于 P3P 的评论以及减少 IE7 和 IE8 问题的快捷解决方案。

回复收藏 0 原文

旧时模样 2024-12-23 17:35:49

我在这里没有看到提到的一种解决方案是使用会话存储而不是cookie。
当然，这可能不适合每个人的要求，但对于某些情况来说这是一个简单的解决方案。

回复收藏 0 原文

在风中等你 2024-12-23 17:35:49

我正在调查有关通过 Azure 访问控制服务登录的问题，但无法连接任何内容的头和尾。

然后，偶然发现了这篇文章 https://blogs.msdn.microsoft.com/ieinternals/2011/03/10/beware-cookie-sharing-in-cross-zone-scenarios/

在简而言之，IE 不会跨区域共享 cookie（例如互联网与受信任的站点）。

因此，如果您的 IFrame 目标和 html 页面位于不同区域，则 P3P 将无济于事。

回复收藏 0 原文

偏闹i 2024-12-23 17:35:49

遇到类似的问题，今天早上也去研究如何生成 P3P 策略，这是我关于如何生成自己的策略并在网站中使用的帖子:)
http://everydayopenslikeaflower.blogspot。 com/2009/08/how-to-create-p3p-policy-and-implement.html

回复收藏 0 原文

甜嗑 2024-12-23 17:35:49

我之前已经实施了完整的 P3P 策略，但不想为我正在开发的新项目再次经历这种麻烦。我发现此链接对于解决问题的简单方法很有用，只需指定“CAO PSA OUR”的最小紧凑 P3P 策略：

http://blog.sweetxml.org/2007/10/minimal-p3p-compact-policy-suggestion.html

该文章引用了 Microsoft 知识库文章的链接（现已损坏）。这项政策对我来说起了作用！

回复收藏 0 原文

∞觅青森が 2024-12-23 17:35:49

您还可以组合 p3p.xml 和 policy.xml 文件，如下所示：

/home/ubuntu/sites/shared/w3c/p3p.xml

<META xmlns="http://www.w3.org/2002/01/P3Pv1">
  <POLICY-REFERENCES>
    <POLICY-REF about="#policy1">
      <INCLUDE>/</INCLUDE>
      <COOKIE-INCLUDE/>
    </POLICY-REF>
  </POLICY-REFERENCES>
  <POLICIES>
    <POLICY discuri="" name="policy1">
      <ENTITY>
        <DATA-GROUP>
          <DATA ref="#business.name"></DATA> 
          <DATA ref="#business.contact-info.online.email"></DATA> 
        </DATA-GROUP>
      </ENTITY>
      <ACCESS>
        <nonident/>
      </ACCESS>
      <!-- if the site has a dispute resolution procedure that it follows, a DISPUTES-GROUP should be included here -->
      <STATEMENT>
        <PURPOSE>
          <current/>
          <admin/>
          <develop/>
        </PURPOSE>
        <RECIPIENT>
          <ours/>
        </RECIPIENT>
        <RETENTION>
          <indefinitely/>
        </RETENTION>
        <DATA-GROUP>
          <DATA ref="#dynamic.clickstream"/>
          <DATA ref="#dynamic.http"/>
        </DATA-GROUP>
      </STATEMENT>
    </POLICY>
  </POLICIES>
</META>

我发现添加标头的最简单方法是通过 Apache 代理并使用 mod_headers，如下所示：

<VirtualHost *:80>
  ServerName mydomain.com

  DocumentRoot /home/ubuntu/sites/shared/w3c/

  ProxyRequests off
  ProxyPass /w3c/ !
  ProxyPass / http://127.0.0.1:8080/
  ProxyPassReverse / http://127.0.0.1:8080/
  ProxyPreserveHost on

  Header add p3p 'P3P:policyref="/w3c/p3p.xml", CP="NID DSP ALL COR"'
</VirtualHost>

因此，我们将除 /w3c/p3p.xml 之外的所有请求代理到我们的应用程序服务器。

您可以使用 W3C 验证器进行全部测试

You can also combine the p3p.xml and policy.xml files as such:

/home/ubuntu/sites/shared/w3c/p3p.xml

<META xmlns="http://www.w3.org/2002/01/P3Pv1">
  <POLICY-REFERENCES>
    <POLICY-REF about="#policy1">
      <INCLUDE>/</INCLUDE>
      <COOKIE-INCLUDE/>
    </POLICY-REF>
  </POLICY-REFERENCES>
  <POLICIES>
    <POLICY discuri="" name="policy1">
      <ENTITY>
        <DATA-GROUP>
          <DATA ref="#business.name"></DATA> 
          <DATA ref="#business.contact-info.online.email"></DATA> 
        </DATA-GROUP>
      </ENTITY>
      <ACCESS>
        <nonident/>
      </ACCESS>
      <!-- if the site has a dispute resolution procedure that it follows, a DISPUTES-GROUP should be included here -->
      <STATEMENT>
        <PURPOSE>
          <current/>
          <admin/>
          <develop/>
        </PURPOSE>
        <RECIPIENT>
          <ours/>
        </RECIPIENT>
        <RETENTION>
          <indefinitely/>
        </RETENTION>
        <DATA-GROUP>
          <DATA ref="#dynamic.clickstream"/>
          <DATA ref="#dynamic.http"/>
        </DATA-GROUP>
      </STATEMENT>
    </POLICY>
  </POLICIES>
</META>

I found the easiest way to add a header is proxy through Apache and use mod_headers, as such:

<VirtualHost *:80>
  ServerName mydomain.com

  DocumentRoot /home/ubuntu/sites/shared/w3c/

  ProxyRequests off
  ProxyPass /w3c/ !
  ProxyPass / http://127.0.0.1:8080/
  ProxyPassReverse / http://127.0.0.1:8080/
  ProxyPreserveHost on

  Header add p3p 'P3P:policyref="/w3c/p3p.xml", CP="NID DSP ALL COR"'
</VirtualHost>

So we proxy all requests except those to /w3c/p3p.xml to our application server.

You can test it all with the W3C validator

回复收藏 0 原文

许一世地老天荒 2024-12-23 17:35:49

如果您拥有需要嵌入的域，那么您可以在调用包含 IFrame 的页面之前重定向到该域，这将创建 cookie 并重定向回来，
如此处所述：http://www.mendoweb。 be/blog/internet-explorer-safari-third-party-cookie-problem/

这适用于 Internet Explorer，但也适用于 Safari（因为 Safari 也会阻止第三方 cookie）。

回复收藏 0 原文

说好的呢 2024-12-23 17:35:49

我知道现在对这个主题做出贡献有点晚了，但我浪费了很多时间，也许这个答案会对某人有所帮助。

我试图在我的网站上调用第三方 cookie，当然它在 Internet Explorer 10 上不起作用，即使安全级别较低......不要问我为什么。在 iframe 中，我使用 ajax 调用 read_cookie.php (echo $_COOKIE)。

我不知道为什么我无法设置 P3P 策略来解决问题......

在我的搜索过程中，我看到了一些关于让 cookie 在 JSON 中工作的信息。我什至没有尝试，因为我认为如果 cookie 不会通过 iframe，它就不会再通过数组传递......

你猜怎么着，它确实如此！因此，如果您对 cookie 进行 json_encode，然后在 ajax 请求后进行解码，您就会得到它！

也许我错过了一些事情，如果我错过了，我很抱歉，但我从来没有见过如此愚蠢的事情。为了安全起见，阻止第三方 cookie，为什么不呢，但如果经过编码就让它通过呢？现在保安在哪里？

我希望这篇文章能对某人有所帮助，如果我错过了一些东西并且我很愚蠢，请教育我！

回复收藏 0 原文

原谅过去的我 2024-12-23 17:35:49

这最终对我有用（经过一番努力并使用 IBM 策略生成器生成了一些策略）。您可以在此处下载策略生成器：http://www .softpedia.com/get/Security/Security-Related/P3P-Policy-Editor.shtml

我无法再从 IBM 官方网站下载生成器。

我在 Web 应用程序

/index.php
/w3c/policy.html (Human readable format)
/w3c/p3p.xml
/w3c/policy.p3p

Index.php 的根文件夹中创建了这些文件：只需发送一个附加标头：

header('P3P: policyref="/w3c/p3p.xml", CP="ALL DSP NID CURa ADMa DEVa HISa OTPa OUR NOR NAV DEM"');

p3p.xml 的内容

<META>
    <POLICY-REFERENCES>
        <POLICY-REF about="/w3c/policy.p3p#App">
            <INCLUDE>/</INCLUDE>
            <COOKIE-INCLUDE/>
        </POLICY-REF>
    </POLICY-REFERENCES>
</META>

我的 policy.html 文件的内容

<html>
<head>
<STYLE type="text/css">
title { color: #3333FF}
</STYLE>
<title>Privacy Statement for YOUR COMPANY NAME</title>
</head>
<body>
<h1 class="title">Privacy Policy</h1>
<!-- "About Us" section of privacy policy -->
<h2>About Us</h2>
<p>This is a privacy policy for YOUR COMPANY NAME.
Our homepage on the Web is located at <a href="YOURWEBSITE">
YOURWEBSITE</a>.
The full text of our privacy policy is available on the Web at 
<a href="ABSOLUTE URL OF THIS FILE">
ABSOLUTE URL OF THIS FILE</a>
This policy does not tell users where they can go to exercise their opt-in or opt-out options.
<p>We invite you to contact us if you have questions about this policy.
You may contact us by mail at the following address:
<pre>FIRSTNAME LASTNAME
YOUR ADDRESS HERE
</pre>
<p>You may contact us by e-mail at 
<a href="mailto:[email protected]">
[email protected]</a>. 
You may call us at TELEPHONENUMBER.
<!-- "Privacy Seals" section of privacy policy -->
<h2>Dispute Resolution and Privacy Seals</h2>
<p>We have the following privacy seals and/or dispute resolution mechanisms.
If you think we have not followed our privacy policy in some way, they can help you resolve your concern.
<ul>
<li>
<b>Dispute</b>:
Contact us for further information
</ul>
<!-- "Additional information" section of privacy policy -->
<h2>Additional Information</h2>
<p>
This policy is valid for 1 day from the time that it is loaded by a client.
</p>
<!-- "Data Collection" section of privacy policy -->
<h2>Data Collection</h2>
<p>P3P policies declare the data they collect in groups (also referred to as "statements").
This policy contains 1 data group.
<hr width="50%" align="center">
<h3>Group "App control data"</h3>
<p>We collect the following information:
<ul>
<li>HTTP cookies</li>
</ul>
<p>This data will be used for the following purposes:</p>
<ul>
<li>Completion and support of the current activity.</li>
<li>Web site and system administration.</li>
<li>Research and development.</li>
<li>Historical preservation.</li>
<li>Other purposes<p>Control Flow of the application</p></li>
</ul>
<p>This data will be used by ourselves and our agents.
<p>The data in this group has been marked as non-identifiable. This means that there is no
reasonable way for the site to identify the individual person this data was collected from.
<p>The following explanation is provided for why this data is collected:</p>
<blockquote>This cookie data is only used to control the application within an iframe (e.g. a Facebook App)</blockquote>
<!-- "Use of Cookies" section of privacy policy -->
<hr width="50%" align="center">
<h2>Cookies</h2>
<p>Cookies are a technology which can be used to provide you with tailored information from a Web site. A cookie is an element of data that a Web site can send to your browser, which may then store it on your system. You can set your browser to notify you when you receive a cookie, giving you the chance to decide whether to accept it.
<p>Our site makes use of cookies.
Cookies are used for the following purposes:
<ul>
<li>Site administration
<li>Completing the user's current activity
<li>Research and development
<li>Other
(Control Flow of the application)
</ul>
<!-- "Compact Policy Explanation" section of privacy policy -->
<hr width="50%" align="center">
<h2>Compact Policy Summary</h2>
<p>The compact policy which corresponds to this policy is:
<pre>
    CP="ALL DSP NID CURa ADMa DEVa HISa OTPa OUR NOR NAV"
</pre>
<p>The following table explains the meaning of each field in the compact policy.
<center><table width="80%" border="1" cols="2">
<tr><td align="center" valign="top" width="20%"><b>Field</b></td><td align="center" valign="top" width="80%"><b>Meaning</b></td></tr>
<tr><td align="left" valign="top" width="20%"><tt>CP=</tt></td>
<td align="left" valign="top" width="80%">This is the compact policy header; it indicates that what follows is a P3P compact policy.</td></tr>
<tr><td align="left" valign="top" width="20%"><tt>ALL</tt></td>
<td align="left" valign="top" width="80%">
Access to all collected information is available.
</td></tr>
<tr><td align="left" valign="top" width="20%"><tt>DSP</tt></td>
<td align="left" valign="top" width="80%">
The policy contains at least one dispute-resolution mechanism.
</td></tr>
<tr><td align="left" valign="top" width="20%"><tt>NID</tt></td>
<td align="left" valign="top" width="80%">
The information collected is not personally identifiable.
</td></tr>
<tr><td align="left" valign="top" width="20%"><tt>CURa</tt></td>
<td align="left" valign="top" width="80%">
The data is used for completion of the current activity.
</td></tr>
<tr><td align="left" valign="top" width="20%"><tt>ADMa</tt></td>
<td align="left" valign="top" width="80%">
The data is used for site administration.
</td></tr>
<tr><td align="left" valign="top" width="20%"><tt>DEVa</tt></td>
<td align="left" valign="top" width="80%">
The data is used for research and development.
</td></tr>
<tr><td align="left" valign="top" width="20%"><tt>HISa</tt></td>
<td align="left" valign="top" width="80%">
The data is used for historical archival purposes.
</td></tr>
<tr><td align="left" valign="top" width="20%"><tt>OTPa</tt></td>
<td align="left" valign="top" width="80%">
The data is used for other purposes.
</td></tr>
<tr><td align="left" valign="top" width="20%"><tt>OUR</tt></td>
<td align="left" valign="top" width="80%">
The data is given to ourselves and our agents.
</td></tr>
<tr><td align="left" valign="top" width="20%"><tt>NOR</tt></td>
<td align="left" valign="top" width="80%">
The data is not kept beyond the current transaction.
</td></tr>
<tr><td align="left" valign="top" width="20%"><tt>NAV</tt></td>
<td align="left" valign="top" width="80%">
Navigation and clickstream data is collected.
</td></tr>
</table></center>
<p>The compact policy is sent by the Web server along with the cookies it describes.
For more information, see the P3P deployment guide at <a href="http://www.w3.org/TR/p3pdeployment">http://www.w3.org/TR/p3pdeployment</a>.
<!-- "Policy Evaluation" section of privacy policy -->
<hr width="50%" align="center">
<h2>Policy Evaluation</h2>
<p>Microsoft Internet Explorer 6 will evaluate this policy's compact policy whenever it is used with a cookie.
The actions IE will take depend on what privacy level the user has selected in their browser (Low, Medium, Medium High, or High; the default is Medium.
In addition, IE will examine whether the cookie's policy is considered satisfactory or unsatisfactory, whether the cookie is a session cookie or a persistent cookie, and whether the cookie is used in a first-party or third-party context.
This section will attempt to evaluate this policy's compact policy against Microsoft's stated behavior for IE6.
<p><b>Note:</b> this evaluation is currently experimental and should not be considered a substitute for testing with a real Web browser.
<p><b>Satisfactory policy</b>: this compact policy is considered <em>satisfactory</em> according to the rules defined by Internet Explorer 6.
IE6 will accept cookies accompanied by this policy under the High, Medium High, Medium, Low, and Accept All Cookies settings.
</body></html>

政策内容.p3p

<?xml version="1.0"?>
<POLICIES xmlns="http://www.w3.org/2002/01/P3Pv1">
    <!-- Generated by IBM P3P Policy Editor version Beta 1.12 built 2/27/04 1:19 PM -->

    <!-- Expiry information for this policy -->
    <EXPIRY max-age="86400"/>

<POLICY
    name="App"
    discuri="ABSOLUTE URL TO policy.html"
    xml:lang="de">
    <!-- Description of the entity making this policy statement. -->
    <ENTITY>
    <DATA-GROUP>
<DATA ref="#business.name">COMPANY NAME</DATA>
<DATA ref="#business.contact-info.online.email">[email protected]</DATA>
<DATA ref="#business.contact-info.online.uri">YOURWEBSITE</DATA>
<DATA ref="#business.contact-info.telecom.telephone.number">YOURPHONENUMBER</DATA>
<DATA ref="#business.contact-info.postal.organization">FIRSTNAME LASTNAME</DATA>
<DATA ref="#business.contact-info.postal.street">STREET</DATA>
<DATA ref="#business.contact-info.postal.city">CITY</DATA>
<DATA ref="#business.contact-info.postal.stateprov">STAGE</DATA>
<DATA ref="#business.contact-info.postal.postalcode">POSTALCODE</DATA>
<DATA ref="#business.contact-info.postal.country">Germany</DATA>
    </DATA-GROUP>
    </ENTITY>

    <!-- Disclosure -->
    <ACCESS><all/></ACCESS>


    <!-- Disputes -->
    <DISPUTES-GROUP>
        <DISPUTES resolution-type="service" service="YOURWEBSITE CONTACT FORM" short-description="Dispute">
            <LONG-DESCRIPTION>Contact us for further information</LONG-DESCRIPTION>
    <!-- No remedies specified -->
        </DISPUTES>
    </DISPUTES-GROUP>

    <!-- Statement for group "App control data" -->
    <STATEMENT>
        <EXTENSION optional="yes">
            <GROUP-INFO xmlns="http://www.software.ibm.com/P3P/editor/extension-1.0.html" name="App control data"/>
        </EXTENSION>

    <!-- Consequence -->
    <CONSEQUENCE>
This cookie data is only used to control the application within an iframe (e.g. a Facebook App)</CONSEQUENCE>

    <!-- Data in this statement is marked as being non-identifiable -->
    <NON-IDENTIFIABLE/>

    <!-- Use (purpose) -->
    <PURPOSE><admin/><current/><develop/><historical/><other-purpose>Control Flow of the application</other-purpose></PURPOSE>

    <!-- Recipients -->
    <RECIPIENT><ours/></RECIPIENT>

    <!-- Retention -->
    <RETENTION><no-retention/></RETENTION>

    <!-- Base dataschema elements. -->
    <DATA-GROUP>
    <DATA ref="#dynamic.cookies"><CATEGORIES><navigation/></CATEGORIES></DATA>
    </DATA-GROUP>
</STATEMENT>

<!-- End of policy -->
</POLICY>
</POLICIES>

This finally worked for me (after a lot of hastle and generating some policies using IBMs policy generator). You can downlod the policy generator here: http://www.softpedia.com/get/Security/Security-Related/P3P-Policy-Editor.shtml

I was not able to download the generator from the official IBM website any more.

I created these files in the root folder of my Web-App

/index.php
/w3c/policy.html (Human readable format)
/w3c/p3p.xml
/w3c/policy.p3p

Index.php: Just send an additional header:

header('P3P: policyref="/w3c/p3p.xml", CP="ALL DSP NID CURa ADMa DEVa HISa OTPa OUR NOR NAV DEM"');

Content of p3p.xml

<META>
    <POLICY-REFERENCES>
        <POLICY-REF about="/w3c/policy.p3p#App">
            <INCLUDE>/</INCLUDE>
            <COOKIE-INCLUDE/>
        </POLICY-REF>
    </POLICY-REFERENCES>
</META>

Content of my policy.html file

<html>
<head>
<STYLE type="text/css">
title { color: #3333FF}
</STYLE>
<title>Privacy Statement for YOUR COMPANY NAME</title>
</head>
<body>
<h1 class="title">Privacy Policy</h1>
<!-- "About Us" section of privacy policy -->
<h2>About Us</h2>
<p>This is a privacy policy for YOUR COMPANY NAME.
Our homepage on the Web is located at <a href="YOURWEBSITE">
YOURWEBSITE</a>.
The full text of our privacy policy is available on the Web at 
<a href="ABSOLUTE URL OF THIS FILE">
ABSOLUTE URL OF THIS FILE</a>
This policy does not tell users where they can go to exercise their opt-in or opt-out options.
<p>We invite you to contact us if you have questions about this policy.
You may contact us by mail at the following address:
<pre>FIRSTNAME LASTNAME
YOUR ADDRESS HERE
</pre>
<p>You may contact us by e-mail at 
<a href="mailto:[email protected]">
[email protected]</a>. 
You may call us at TELEPHONENUMBER.
<!-- "Privacy Seals" section of privacy policy -->
<h2>Dispute Resolution and Privacy Seals</h2>
<p>We have the following privacy seals and/or dispute resolution mechanisms.
If you think we have not followed our privacy policy in some way, they can help you resolve your concern.
<ul>
<li>
<b>Dispute</b>:
Contact us for further information
</ul>
<!-- "Additional information" section of privacy policy -->
<h2>Additional Information</h2>
<p>
This policy is valid for 1 day from the time that it is loaded by a client.
</p>
<!-- "Data Collection" section of privacy policy -->
<h2>Data Collection</h2>
<p>P3P policies declare the data they collect in groups (also referred to as "statements").
This policy contains 1 data group.
<hr width="50%" align="center">
<h3>Group "App control data"</h3>
<p>We collect the following information:
<ul>
<li>HTTP cookies</li>
</ul>
<p>This data will be used for the following purposes:</p>
<ul>
<li>Completion and support of the current activity.</li>
<li>Web site and system administration.</li>
<li>Research and development.</li>
<li>Historical preservation.</li>
<li>Other purposes<p>Control Flow of the application</p></li>
</ul>
<p>This data will be used by ourselves and our agents.
<p>The data in this group has been marked as non-identifiable. This means that there is no
reasonable way for the site to identify the individual person this data was collected from.
<p>The following explanation is provided for why this data is collected:</p>
<blockquote>This cookie data is only used to control the application within an iframe (e.g. a Facebook App)</blockquote>
<!-- "Use of Cookies" section of privacy policy -->
<hr width="50%" align="center">
<h2>Cookies</h2>
<p>Cookies are a technology which can be used to provide you with tailored information from a Web site. A cookie is an element of data that a Web site can send to your browser, which may then store it on your system. You can set your browser to notify you when you receive a cookie, giving you the chance to decide whether to accept it.
<p>Our site makes use of cookies.
Cookies are used for the following purposes:
<ul>
<li>Site administration
<li>Completing the user's current activity
<li>Research and development
<li>Other
(Control Flow of the application)
</ul>
<!-- "Compact Policy Explanation" section of privacy policy -->
<hr width="50%" align="center">
<h2>Compact Policy Summary</h2>
<p>The compact policy which corresponds to this policy is:
<pre>
    CP="ALL DSP NID CURa ADMa DEVa HISa OTPa OUR NOR NAV"
</pre>
<p>The following table explains the meaning of each field in the compact policy.
<center><table width="80%" border="1" cols="2">
<tr><td align="center" valign="top" width="20%"><b>Field</b></td><td align="center" valign="top" width="80%"><b>Meaning</b></td></tr>
<tr><td align="left" valign="top" width="20%"><tt>CP=</tt></td>
<td align="left" valign="top" width="80%">This is the compact policy header; it indicates that what follows is a P3P compact policy.</td></tr>
<tr><td align="left" valign="top" width="20%"><tt>ALL</tt></td>
<td align="left" valign="top" width="80%">
Access to all collected information is available.
</td></tr>
<tr><td align="left" valign="top" width="20%"><tt>DSP</tt></td>
<td align="left" valign="top" width="80%">
The policy contains at least one dispute-resolution mechanism.
</td></tr>
<tr><td align="left" valign="top" width="20%"><tt>NID</tt></td>
<td align="left" valign="top" width="80%">
The information collected is not personally identifiable.
</td></tr>
<tr><td align="left" valign="top" width="20%"><tt>CURa</tt></td>
<td align="left" valign="top" width="80%">
The data is used for completion of the current activity.
</td></tr>
<tr><td align="left" valign="top" width="20%"><tt>ADMa</tt></td>
<td align="left" valign="top" width="80%">
The data is used for site administration.
</td></tr>
<tr><td align="left" valign="top" width="20%"><tt>DEVa</tt></td>
<td align="left" valign="top" width="80%">
The data is used for research and development.
</td></tr>
<tr><td align="left" valign="top" width="20%"><tt>HISa</tt></td>
<td align="left" valign="top" width="80%">
The data is used for historical archival purposes.
</td></tr>
<tr><td align="left" valign="top" width="20%"><tt>OTPa</tt></td>
<td align="left" valign="top" width="80%">
The data is used for other purposes.
</td></tr>
<tr><td align="left" valign="top" width="20%"><tt>OUR</tt></td>
<td align="left" valign="top" width="80%">
The data is given to ourselves and our agents.
</td></tr>
<tr><td align="left" valign="top" width="20%"><tt>NOR</tt></td>
<td align="left" valign="top" width="80%">
The data is not kept beyond the current transaction.
</td></tr>
<tr><td align="left" valign="top" width="20%"><tt>NAV</tt></td>
<td align="left" valign="top" width="80%">
Navigation and clickstream data is collected.
</td></tr>
</table></center>
<p>The compact policy is sent by the Web server along with the cookies it describes.
For more information, see the P3P deployment guide at <a href="http://www.w3.org/TR/p3pdeployment">http://www.w3.org/TR/p3pdeployment</a>.
<!-- "Policy Evaluation" section of privacy policy -->
<hr width="50%" align="center">
<h2>Policy Evaluation</h2>
<p>Microsoft Internet Explorer 6 will evaluate this policy's compact policy whenever it is used with a cookie.
The actions IE will take depend on what privacy level the user has selected in their browser (Low, Medium, Medium High, or High; the default is Medium.
In addition, IE will examine whether the cookie's policy is considered satisfactory or unsatisfactory, whether the cookie is a session cookie or a persistent cookie, and whether the cookie is used in a first-party or third-party context.
This section will attempt to evaluate this policy's compact policy against Microsoft's stated behavior for IE6.
<p><b>Note:</b> this evaluation is currently experimental and should not be considered a substitute for testing with a real Web browser.
<p><b>Satisfactory policy</b>: this compact policy is considered <em>satisfactory</em> according to the rules defined by Internet Explorer 6.
IE6 will accept cookies accompanied by this policy under the High, Medium High, Medium, Low, and Accept All Cookies settings.
</body></html>

Content of policy.p3p

<?xml version="1.0"?>
<POLICIES xmlns="http://www.w3.org/2002/01/P3Pv1">
    <!-- Generated by IBM P3P Policy Editor version Beta 1.12 built 2/27/04 1:19 PM -->

    <!-- Expiry information for this policy -->
    <EXPIRY max-age="86400"/>

<POLICY
    name="App"
    discuri="ABSOLUTE URL TO policy.html"
    xml:lang="de">
    <!-- Description of the entity making this policy statement. -->
    <ENTITY>
    <DATA-GROUP>
<DATA ref="#business.name">COMPANY NAME</DATA>
<DATA ref="#business.contact-info.online.email">[email protected]</DATA>
<DATA ref="#business.contact-info.online.uri">YOURWEBSITE</DATA>
<DATA ref="#business.contact-info.telecom.telephone.number">YOURPHONENUMBER</DATA>
<DATA ref="#business.contact-info.postal.organization">FIRSTNAME LASTNAME</DATA>
<DATA ref="#business.contact-info.postal.street">STREET</DATA>
<DATA ref="#business.contact-info.postal.city">CITY</DATA>
<DATA ref="#business.contact-info.postal.stateprov">STAGE</DATA>
<DATA ref="#business.contact-info.postal.postalcode">POSTALCODE</DATA>
<DATA ref="#business.contact-info.postal.country">Germany</DATA>
    </DATA-GROUP>
    </ENTITY>

    <!-- Disclosure -->
    <ACCESS><all/></ACCESS>


    <!-- Disputes -->
    <DISPUTES-GROUP>
        <DISPUTES resolution-type="service" service="YOURWEBSITE CONTACT FORM" short-description="Dispute">
            <LONG-DESCRIPTION>Contact us for further information</LONG-DESCRIPTION>
    <!-- No remedies specified -->
        </DISPUTES>
    </DISPUTES-GROUP>

    <!-- Statement for group "App control data" -->
    <STATEMENT>
        <EXTENSION optional="yes">
            <GROUP-INFO xmlns="http://www.software.ibm.com/P3P/editor/extension-1.0.html" name="App control data"/>
        </EXTENSION>

    <!-- Consequence -->
    <CONSEQUENCE>
This cookie data is only used to control the application within an iframe (e.g. a Facebook App)</CONSEQUENCE>

    <!-- Data in this statement is marked as being non-identifiable -->
    <NON-IDENTIFIABLE/>

    <!-- Use (purpose) -->
    <PURPOSE><admin/><current/><develop/><historical/><other-purpose>Control Flow of the application</other-purpose></PURPOSE>

    <!-- Recipients -->
    <RECIPIENT><ours/></RECIPIENT>

    <!-- Retention -->
    <RETENTION><no-retention/></RETENTION>

    <!-- Base dataschema elements. -->
    <DATA-GROUP>
    <DATA ref="#dynamic.cookies"><CATEGORIES><navigation/></CATEGORIES></DATA>
    </DATA-GROUP>
</STATEMENT>

<!-- End of policy -->
</POLICY>
</POLICIES>

回复收藏 0 原文

缱绻入梦 2024-12-23 17:35:49

在Rails中我使用这个gem： https://github.com/merchii/rack-iframe
实际上，它设置了一组没有参考文件的缩写： https://github.com/merchii/rack-iframe/blob/master/lib/rack/iframe.rb#L8

当你完全不关心其含义时，安装起来很容易p3p 的东西。

回复收藏 0 原文

江心雾 2024-12-23 17:35:49

对于任何试图让 P3P 紧凑策略与静态内容一起工作的人：

仅如果您能够发送带有静态内容的自定义服务器端响应标头，则这是可能的。

有关更详细的说明，请参阅我的回答：在 HTML 中设置 P3P 代码

回复收藏 0 原文

轮廓§ 2024-12-23 17:35:49

在Rails 3.2中我使用：

class ApplicationController < ActionController::Base  

  before_filter :set_p3p  

  private  
    # for IE session cookies thru iframe  
    def set_p3p  
      headers['P3P'] = 'CP="ALL DSP COR CURa ADMa DEVa OUR IND COM NAV"'  
    end  
end

我从以下位置得到这个： http://dot-net-web-developer-bristol.blogspot.com/2012/04/setting-p3p-header-in-rails-session.html

In Rails 3.2 I am using:

class ApplicationController < ActionController::Base  

  before_filter :set_p3p  

  private  
    # for IE session cookies thru iframe  
    def set_p3p  
      headers['P3P'] = 'CP="ALL DSP COR CURa ADMa DEVa OUR IND COM NAV"'  
    end  
end

I got this from: http://dot-net-web-developer-bristol.blogspot.com/2012/04/setting-p3p-header-in-rails-session.html

回复收藏 0 原文

苏佲洛 2024-12-23 17:35:49

更好的解决方案是在 iframe 内对页面进行 Ajax 调用，以获取/设置 cookie...

回复收藏 0 原文

Cookie 被阻止/未保存在 Internet Explorer 的 IFRAME 中

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

评论（22）

发生的情况

如何解决该问题

创建 p3p 策略

政策链接

发送带有响应的紧凑标头，

利润！

编辑：不应该做什么，除非你想免受诉讼

What's happening

How to solve it

Create a p3p policy

Link to the policy

Send the compact header with responses

Profit!

Edit: What NOT to do, unless you like defending from lawsuits

对于任何试图让 P3P 紧凑策略与静态内容一起工作的人：

For anyone trying to get the P3P Compact Policy working with static content:

关于作者

相关话题

热门标签

推荐作者

饮湿

明月

02

hs1283

风向决定发型

落花浅忆

友情链接

Cookie 被阻止/未保存在 Internet Explorer 的 IFRAME 中

如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

评论（22）

发生的情况

如何解决该问题

创建 p3p 策略

政策链接

发送带有响应的紧凑标头，

利润！

编辑：不应该做什么，除非你想免受诉讼

What's happening

How to solve it

Create a p3p policy

Link to the policy

Send the compact header with responses

Profit!

Edit: What NOT to do, unless you like defending from lawsuits

对于任何试图让 P3P 紧凑策略与静态内容一起工作的人：

For anyone trying to get the P3P Compact Policy working with static content:

关于作者

相关话题

热门标签

推荐作者

饮湿

明月

02

hs1283

风向决定发型

落花浅忆

友情链接

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。