2

I have a Java application that sets a cookie:

    Cookie keks = new Cookie("Demo","WeLoveCookies");
    keks.setHttpOnly(true);
    keks.setSecure(true);
    keks.setPath("/");
    response.addCookie(keks);

when opening the URL that does that, it gets set in the browser (Set-Cookie header) and send with all future requests (e.g. following a link on the same host).

When embedding that URL as a canvas application, the Set-Cookie header is still present (Header: Set-Cookie: Demo=WeLoveCookies; Path=/; Secure; HttpOnly), however the cookie doesn't get stored (don't see it in the Chrome developer tools) and hence not send back with any further request.

What do I miss?

  • Is it in a frame? Is your site secure? Did you set an expiration date (I don't see one)? Did you specify the domain of your app for the cookie (might be triggering 3P cookie policies)? Have you tried using your canvas app as a top-level application instead (change to OAuth to test logging in)? This is practically a normal HTML/HTTP type problem, rather than a Salesforce-specific problem, but I feel that it might be useful to know for other canvas developers. – sfdcfox Feb 20 '18 at 0:53
  • App is secure. Tried with and without expiry date. I have a top level login and a Postman test (posting the signed_request harvested from Chrome devTools. In both cases the cookie gets set as expected - with or without expiration date. Only inside Canvas’ iFrame it gets ignored. Will test adding the Domain – stwissel Feb 20 '18 at 1:19
0

Cookies are foreigners, sometimes

Turns out it was a browser setting regarding cookies. My Chrome was set to "Block third-party cookies". When opening the URL directly, the cookies it tries to set are native. When the page opens in a vanilla iFrame, the cookies inside the iFrame are native to that iFrame and get set.

In canvas however the cookies the document inside the iFrame wants to set are considered 3rd-party and thus were blocked. Once I permitted these 3rd-party cookies, they started to work.

In summary:

When integrating an application via canvas make sure that cookies from all domains involved are permitted to be loaded!

I created a sample project to show the result.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.