I host a webservice, and provide my members with a Javascript bookmarklet, which loads a JS sript from my server. However, clients must be logged in, in order to receive the JS script. This works for almost everybody. However, some users on setups (i.e. browser/OS) that are known to work for other people have the following problem: when they request the script via the javascript bookmarklet from my server, their cookie from my server does not get included with the request, and as such they are always "not authenticated".

I'm making the request in the following way:

var myScript = eltCreate('script');

In a fit of confused desperation, I changed the script page to simply output "My cookie has [x] elements" where [x] is count($_COOKIE). If this extremely small subset of users requests the script via the normal method, the message reads "My cookie has 0 elements". When they access the URL directly in their browser, the message reads "My cookie has 7 elements".

What on earth could be going on?!

  • I think this is a question that fits better on stackoverflow. Commented Nov 25, 2010 at 16:35
  • If so, please migrate it with my apologies. I was just expecting the equivalent objection to it there.
    – Mala
    Commented Nov 25, 2010 at 22:06
  • In my POV it makes more sense there, and I really think you should get more help there, hence it worth a try. But let's moderation make their job ;) Commented Nov 26, 2010 at 3:24
  • I have posted it to SO, but don't seem to have enough reputation here to vote to close this question
    – Mala
    Commented Dec 2, 2010 at 2:46

3 Answers 3


I think that a proxy or the ISP filters those cookies from scripts out. Mobile ISPs are known to do such nasty things, like Vodafone, which e.g. puts every script and CSS into the HTML page as inline <script ...> or <style ...>. I would ask by the clients what kind of internet access they have, and to send you a saved copy of the HTML-page, which they get, when they access your site.

  • Ah I had no idea ISPs did that! Do you know if there's a way to "whitelist" this behavior?
    – Mala
    Commented Nov 25, 2010 at 21:59
  • Unfortunatelly I don't know any possibility, to avoid this. :(
    – bdadam
    Commented Nov 26, 2010 at 12:39

Browser access is different from embedding a script.

Cookies are sent along with HTTP Request. Browsers does that automatically when you click or type an address on them, embedding script usually does not.

I think you can look at Delicious Link Rolls solution provided by yahoo to get a better idea. Also, study that using Firefox + Firebug + Firecookie, and check into Network tab the request headers that pump up.

  • 1
    the odd thing is that it doesn't seem to be consistent - one person's not working on Windows XP with FF 3.6, yet my Windows XP with FF 3.6 works just fine, as do pretty much everyone else's setup... I guess I'm just confused about the lack of consistency
    – Mala
    Commented Nov 25, 2010 at 21:59

Just a guess:

May it have to do with (dis)allowing third party cookies? It’s a setting in many browsers.

Your cookie would probably count as third party, as the bookmarklet is hosted locally, not at your host.

EDIT: Ah, found your question on SO. So my assumption seems to be correct.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.