6

Is it possible to block cookies that are set by externally hosted content embedded in a page?

For example if I embed an image from a CDN, the response for this image may contain a Set-Cookie header, which results in the cookie showing up for my site.

Just to clarify, I am not asking whether it's possible to do this with client-side browser configurations. I'm asking whether there is something I can do as the website owner in order to prevent cookies being set by images hosted on a separate server.

I don't believe this is possible, I am just asking here in case I missed something.

Improve this question
7
  • If you think that's possible then your with the wrong CDN... you can destory a cookie using PHP using IF and ELSE then using unset($_COOKIE['Example]);
    – Simon Hayter
    Mar 14, 2018 at 22:36
  • Thanks for your reply. I don't think that what I am proposing is possible. Also can you explain what you mean by "then your with the wrong CDN?". Using PHP would remove the cookie, but since PHP on the origin will run before the client requests the image, the cookie would just be set again. Also, I really don't want the cookie to be set at all. Thanks
    – jamieweb
    Mar 14, 2018 at 22:49
  • If you think your CDN provider is risky then your with the wrong host.
    – Simon Hayter
    Mar 15, 2018 at 0:42
  • 1
    "which results in the cookie showing up for my site." - What do you mean by this? The cookie won't show up on your site, it will show up on the domain of the "externally hosted content".
    – MrWhite
    Mar 15, 2018 at 0:57
  • 1
    Externally hosted JavaScript that runs in the context of your page can set cookies for your domain. Google Analytics does that. But as @MrWhite says, externally hosted images should only be able to set cookies for their own domain, not for your domain, even when included in pages in your site.
    – Stephen Ostermiller on Strike ♦
    Mar 15, 2018 at 16:49

2 Answers 2

Reset to default
4

You have no control over cookies that might be set by an external resource on a different domain. These (third party) cookies are set on the "external domain", not the domain of your site. Fundamental browser/cookie security prevents you from accessing these cookies (client-side) and the browser will never send these cookies back to your domain, so you will not see them server-side.

However, the user can disable third-party cookies in their browser if they wish.

Theoretically, instead of linking directly to the external resource/CDN, you could link to a URL-path on your own domain (or a subdomain) instead. You then setup a reverse proxy on your server to make requests to the external resource and send this to the client. Then, any cookies the external resource tries to set will fail (domain mismatch) - or you could strip the Set-Cookie header in the response. However, this really defeats some of the advantages of using a CDN in the first place, since the request is being routed via your server.

Improve this answer
6
  • 1
    In the latest version of Firefox third party cookies are mostly blocked. They are set, but can only be read by the third party when the first party site matches.
    – Stephen Ostermiller on Strike ♦
    Mar 15, 2018 at 1:35
  • Thanks for your answer, this has confirmed what I thought. The reverse proxy idea is a good one, although as you say it defeats the point of a CDN. For context, I am looking to have my images and other static content served by Cloudflare cache, while my main page content is straight from the origin. It's just that __cfduid cookie that is undesirable and unfortunately impossible to disable (even if you set the security filtering to "Essentially Off"). Thanks!
    – jamieweb
    Mar 15, 2018 at 18:09
  • 1
    @JamieOnUbuntu Why is the __cfduid cookie undesirable? Is this a privacy concern? It is my understanding that this particular cookie is intended to benefit the user - if it was disabled then I imagine some users may not be able to view your content?
    – MrWhite
    Mar 15, 2018 at 19:06
  • The __cfduid cookie is used to remember users who have passed a security challenge recently, so that they don't get challenged again. This isn't specifically a privacy concern, it's just that my site focuses on security, privacy, no ads, no tracking, etc. Having the cookie there just makes me feel a bit dishonest and against motive of the site. I have the security challenges in Cloudflare set to "Essentially Off" so that no users are challenged, but unfortunately the cookie is still set.
    – jamieweb
    Mar 15, 2018 at 19:17
  • 1
    @Zhaph-BenDuguid Nothing has changed AFAIK, unfortunately. (It would certainly make implementing GDPR / Cookie Laws a whole lot easier!)
    – MrWhite
    May 28, 2021 at 16:23
-1

If you're setting the cookie in PHP, there is a way to do it.

If your domain is on http instead of https, you can use the PHP command http_referer. http_referer does not work on https domains.

parse_url($_SERVER['HTTP_REFERER'], PHP_URL_HOST)

The above code gives you the root domain from which the image was loaded.

If http_referer = example.com { set cookie };

The above code template should only set the cookie if the image is loaded on or linked to by an example.com page. Other domains linking to or loading the image won't set the cookie.

Improve this answer
1
  • 3
    You seem to have misread the question... the OP is not trying to set cookies on the current domain, they are trying to "block cookies" that might have already been set on an external domain.
    – MrWhite
    Mar 15, 2018 at 16:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.