Python: setting a cookie to another website

Question

I am introducing one ad system in which, when one user places the script code on their website A. What I want to do at this time is set to cookie A while it displays the response or resource of website B (advertising system), so at the moment, when the user comes again, I can register him. I read this question and found out that you can set a cookie on another site A when this site A displays content from another site B

In the script, I execute one resting API and return one response, as shown below.

source_image = "http://example.com/media/format.png" response = Response({'success':source_image}) response.set_cookie( 'cookie_name', 'cookie_value' ) return response 

Now I can see the cookie set in the response browser of this URL. But when I reload it, the cookie is not displayed. Also why it does not appear in the cookies section of the site where I installed the script code.

Am I doing the right thing to set a cookie? And I tried to set the cookie expiration date to 1 day. But still, it is destroyed. Please, help..

Answer 1

There is some important information about cookies and browsers and how they interact between domains.

• Websites may set cookies for their own website.
• Websites cannot set cookies for another website.
• Cookies can be set in response or use things like JavaScript

The first two may seem confusing, especially when some sources claim that they are possible. It is important to note that they only affect cases where the response directly sets a cookie using the Set-Cookie header, which allows the website to set a cookie directly. There are some special cases for things like subdomains, but in general you should not expect browsers to respect cookies set on other domains that you do not control.

If you were allowed to arbitrarily set cookies on other websites, this would open the door for websites to arbitrarily set and disable cookies that you use, even if they are not connected. This includes the ability to register one of the domains in only one answer, which is impossible.

The third point is important for cases such as advertising, since cookies can be set using the Set-Cookie header (or response.set_cookie in Django ) or using JavaScript via the document.cookie property . Since JavaScript can be enabled from any domain using the src property in the <script> tags , any domain can manage cookies in another domain if it is enabled via JavaScript . This is important for how many analytics services, such as Google Analytics , work because it allows them to store unqiue cookies on every website for every user that is controlled, although they do not have full control over the response. They also commonly use tracking beacons in the form of images to send data back to an external domain and associate them with a saved cookie.

The answer you refer to talks about this with images, but explains that it doesn’t actually set a cookie in another domain . A cookie that is set using an image or frame is stored only in an external domain and cannot be accessed from the domain, including the remote image.

Answer 2

• Verify that the Set-Cookie HTTP header is sent to the client in an HTTP response.
• Try adding the "domain" attribute for the cookie so that the browser knows where to send the cookie.