Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I host a webservice, and provide my members with a Javascript bookmarklet, which loads a JS sript from my server. However, clients must be logged in, in order to receive the JS script. This works for almost everybody. However, some users on setups (i.e. browser/OS) that are known to work for other people have the following problem: when they request the script via the javascript bookmarklet from my server, their cookie from my server does not get included with the request, and as such they are always "not authenticated".

I'm making the request in the following way:

var myScript = eltCreate('script');
myScript.setAttribute('src','http://myserver.com/script');
document.body.appendChild(myScript);

In a fit of confused desperation, I changed the script page to simply output "My cookie has [x] elements" where [x] is count($_COOKIE). If this extremely small subset of users requests the script via the normal method, the message reads "My cookie has 0 elements". When they access the URL directly in their browser, the message reads "My cookie has 7 elements".

What on earth could be going on?!

share|improve this question
    
I think this is a question that fits better on stackoverflow. –  Dave Nov 25 '10 at 16:35
    
If so, please migrate it with my apologies. I was just expecting the equivalent objection to it there. –  Mala Nov 25 '10 at 22:06
    
In my POV it makes more sense there, and I really think you should get more help there, hence it worth a try. But let's moderation make their job ;) –  Dave Nov 26 '10 at 3:24
    
I have posted it to SO, but don't seem to have enough reputation here to vote to close this question –  Mala Dec 2 '10 at 2:46

3 Answers 3

I think that a proxy or the ISP filters those cookies from scripts out. Mobile ISPs are known to do such nasty things, like Vodafone, which e.g. puts every script and CSS into the HTML page as inline <script ...> or <style ...>. I would ask by the clients what kind of internet access they have, and to send you a saved copy of the HTML-page, which they get, when they access your site.

share|improve this answer
    
Ah I had no idea ISPs did that! Do you know if there's a way to "whitelist" this behavior? –  Mala Nov 25 '10 at 21:59
    
Unfortunatelly I don't know any possibility, to avoid this. :( –  bdadam Nov 26 '10 at 12:39

Just a guess:

May it have to do with (dis)allowing third party cookies? It’s a setting in many browsers.

Your cookie would probably count as third party, as the bookmarklet is hosted locally, not at your host.

EDIT: Ah, found your question on SO. So my assumption seems to be correct.

share|improve this answer

Browser access is different from embedding a script.

Cookies are sent along with HTTP Request. Browsers does that automatically when you click or type an address on them, embedding script usually does not.

I think you can look at Delicious Link Rolls solution provided by yahoo to get a better idea. Also, study that using Firefox + Firebug + Firecookie, and check into Network tab the request headers that pump up.

share|improve this answer
1  
the odd thing is that it doesn't seem to be consistent - one person's not working on Windows XP with FF 3.6, yet my Windows XP with FF 3.6 works just fine, as do pretty much everyone else's setup... I guess I'm just confused about the lack of consistency –  Mala Nov 25 '10 at 21:59

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.