Unable to access cookies set by another Domain in IE

Question

I am setting the cookie from a local HTML file as below using cookie.js library

$.cookies.set("Demo","Dummy Data");

From another domain I am trying to get the cookie value using below code

alert($.cookies.get("Demo"));

But it is returning me null.
Please help me on this

Maybe I don't understand what you are doing... but you can't get cookie values from other domains - cookies are sandboxed for security. — Matt H, Dec 08 '11 at 16:03

score 9 · Accepted Answer · answered Dec 08 '11 at 16:03

9

This is by design. You can only get the value of a cookie which was set on the current domain.

What you are asking for is not possible due to the security measures built in to web browsers.

The best alternative is to make a JSONP AJAX request which can cross domains.

answered Dec 08 '11 at 16:03

Rory McCrossan

306,214
37
269
303

4

I'm afraid not, browsers aren't that easily fooled. Which is a very good thing otherwise I'd have access to all the persistent logins you have stored on your browser ;) – Rory McCrossan Dec 08 '11 at 16:04
@RoryMcCrossan Suppose I embed the website, whose cookie I want to access inside an iframe. Is it possible to email the cookie to myself by writing a script tag inside the iframe ? – aka_007 Feb 09 '16 at 06:59
Assuming you have access to the website inside the iframe then yes that's possible. Although emailing the cookie to yourself seems rather odd as you have direct access to it anyway? – Rory McCrossan Feb 09 '16 at 07:38

score 3 · Answer 2 · answered Dec 08 '11 at 16:04

3

You can not read a cookie set by another domain.

answered Dec 08 '11 at 16:04

Roger

909
2
10
17

score 3 · Answer 3 · edited May 23 '17 at 11:59

3

Take a look at this thread about cross-domain cookies: Cross domain cookies

Basically, this is a security feature. If domain.com set a cookies, domain1.com should not have any access to it, otherwise you could get authentication tokens and other stuff for any website.

edited May 23 '17 at 11:59

Community

1
1

answered Dec 08 '11 at 16:04

Sologoub

4,962
4
34
63

score 2 · Answer 4 · answered Dec 08 '11 at 16:05

Unfortunately, it is returning null because cookies from another domain are not accessible. This is a security feature.

Consider, for example, your session cookie for some website. If I could access that cookie via JS on another domain, then my malicious website (that I trick you into visiting), can then take that session information and give it to some hacker. Then it becomes much more likely that the hacker can hijack your session. All too commonly, there are not other measures in place to make sure that the session used is used by the same person, so all a blackhat needs is the ID and voila - total access as you to the website. Say you're logged into your bank on one window, and then have my hacked evil webiste open in the other... now I might be able to access your bank account. Whoops!

So - it's not possible, and for good reason!

score 0 · Answer 5 · edited May 23 '17 at 11:59

Indeed, this is not possible because of SOP (Same Origin Policy).

You can solve this problem with cross domain methods like: postMessage, JSONP, xmlHttpRequest or iframe to name a few.

However, you have to be concerned about security issues. This podcast explain how to breack cross domain barrier. The posts below also have solutions for your problem.

Unable to access cookies set by another Domain in IE

5 Answers5

Stackoverflow Posts

Linked

Related