Setting Cookies at Other Domains

Cookies can be set only by the domain the browser retrieves content from. Content is text, image, style, JavaScript, videos, any content a web page can publish.

It used to be that content obtained from other web sites could set their own cookies. Those are called third-party cookies because the cookies are set by web sites different than the domain in the browser's address bar.

Third-party cookies are unreliable anymore.

Google Chrome will be blocking third-party cookies. Firefox and Safari already have. (More information is at this ad-heavy vox.com web page.)

There are reasons to use third-party cookies — other than for advertising purposes. Here are a few:

• Logging in at one domain for access at another.

• Shopping where discount depends on whether a certain message at another site was seen.

• Sharing preferences between two or more related websites.

With a bit of creativity, most needs can be met by implementing alternative technology.

I'll examine an alternative. It requires you to have admin access for all domains that will be setting a cookie.

This alternative won't be practical for all requirements. It is an example only, included here as a demonstration that alternatives generally can be found.

An Alternative

The current/past method is the browser at a page on website A loads an image from website B. Website B sets a third-party cookie.

An alternative is to send the browser to website B long enough to set a cookie. Then send the browser back to website A.

Instead of setting a cookie when an image or other file is loaded (a method to set third-party cookies), the browser actually lands at website B to get the cookie set. (When a cookie is set at a domain that is in the browser's address bar, the website being visited, it is a first-party cookie, not a third-party.)

To reiterate, this alternative method sends the browser directly to website B, which then sets a first-party cookie. Website B sends the browser back to website A. Website A can now load the image from website B without setting a cookie — because the cookie has already been set.

Probably alternatives can be found for most current third-party cookie implementations. It is just not as simple as it used to be.

(This article first appeared with an issue of the Possibilities newsletter.)

Will Bontrager