ๆฆ่ฆ
iOS13.4ใฎSafariใซใใใฆใใตใผใใใผใใฃCookieใๅฎๅ
จใซใใญใใฏใใใใใใซใชใใพใใใ
่ฉณใใใฏไธ่จใใ็ขบ่ชใใ ใใใ
https://webkit.org/blog/10218/full-third-party-cookie-blocking-and-more/
iOSใฎ ่จญๅฎ๏ผSafari๏ผใตใคใ่ถใใใฉใใญใณใฐใ้ฒใ ใOFFใซใใใจใใตใผใใใผใใฃCookieใฎ่ชญใฟๆธใใๅฏ่ฝใซใชใใพใใใSafariใฎใใใฉใซใใฎ่จญๅฎใงใฏใใตใคใ่ถใใใฉใใญใณใฐใONใจใชใฃใฆใใใใตใผใใใผใใฃCookieใฏใใญใใฏใใใพใใ
ใใใงใฏใไธ่จใฎwebkit.orgใงใตใผใใใผใใฃCookieใๅๅพใใๆนๆณ๏ผOption 2๏ผใจใใฆๆใใใใฆใใ Storage Access API ใ่ฉฆใใฆใฟใพใใ
็ต่ซใใ่จใใพใใจใใตใคใ่ถใใใฉใใญใณใฐใONใฎ็ถๆ
ใงใใตใผใใใผใใฃCookieใๅๅพใใใใจใๅบๆฅใพใใใ๏ผdocument.cookieใฎใฟใ ใ๏ผ
2020ๅนด3ๆ27ๆฅๆ็นใฎiOS13.4 ใฎSafariใงๆค่จผใใฆใใพใใ
ใตใณใใซใณใผใ
ใใกใคใซใไธ่จใฎใใใซ้
็ฝฎใใฆใใ ใใใ
hoge.com
โparent.php
foo.com
โchild.php
โfirst_party_cookie.php
parent.php
iframe ใฟใฐใ่จญ็ฝฎใใใใผใธใซใชใใพใใ
<?php
setcookie("1st-party-from-server", "hoge.com", time() + 86400);
?>
<!DOCTYPE html>
<meta name="viewport" content="width=device-width,initial-scale=1">
<html>
<head>
<meta charset="UTF-8" />
<title>iframe test</title>
</head>
<body>
<div>parent.php</div>
<ul>
<li><a href="http://foo.com/first_party_cookie.php">first party cookie set in foo.com</a></li>
</ul>
<div>
<iframe src="http://foo.com/child.php" width="100%" height="400">
</iframe>
</div>
</body>
</html>
child.php
parent.php ใฎiframeใฎsrcใซ่จญ็ฝฎใใใใผใธใซใชใใพใใ
<?php
setcookie("3rd-party-from-server", "foo.com", time() + 86400);
?>
<!DOCTYPE html>
<meta name="viewport" content="width=device-width,initial-scale=1">
<html>
<head>
<meta charset="UTF-8" />
<title>iframe test</title>
</head>
<body>
<div>child.php</div>
<div>$_COOKIE:<pre><?=htmlspecialchars(print_r($_COOKIE, true), ENT_QUOTES)?></pre></div>
<div><button onclick="callRequestStorageAccess()">callRequestStorageAccess</button></div>
<div><button onclick="getCookieByUserAction()">getCookieByUserAction</button></div>
<script>
window.onload = function() {
console.log("Cookie when loading:" + document.cookie);
var promise = document.hasStorageAccess();
promise.then(
function (hasAccess) {
// Boolean hasAccess says whether the document has access or not.
console.log("hasStorageAccess when loading:" + hasAccess);
}
);
}
function callRequestStorageAccess() {
var promise = document.requestStorageAccess();
promise.then(
function () {
console.log("Storage access was granted");
},
function () {
console.log("Storage access was denied");
}
);
}
function getCookieByUserAction() {
console.log("Cookie when user action:" + document.cookie);
var promise = document.hasStorageAccess();
promise.then(
function (hasAccess) {
// Boolean hasAccess says whether the document has access or not.
console.log("hasStorageAccess when user action:" + hasAccess);
}
);
}
</script>
</body>
</html>
first_party_cookie.php
foo.com ใฎใใกใผในใใใผใใฃCookieใSetใใใใใซ็จๆใใพใใiframeๅ ใงใฏใชใTOPใใฌใผใ ใจใใฆ้ท็งปใใๅฟ ่ฆใใใใพใใ
<?php
setcookie("1st-party-from-server", "foo.com", time() + 86400);
?>
<!DOCTYPE html>
<meta name="viewport" content="width=device-width,initial-scale=1">
<html>
<head>
<meta charset="UTF-8" />
<title>first-paty-cookie</title>
</head>
<body>
<div>first_party_cookie.php</div>
<div>
$_COOKIE:<pre><?=htmlspecialchars(print_r($_COOKIE, true), ENT_QUOTES)?></pre>
</div>
<div><button onclick="history.back()">back</button></div>
<script>
document.cookie = "1st-party-from-js=foo.com";
</script>
</body>
</html>
็ขบ่ชๆนๆณ
ๅฎๆฉใฎiPhoneใจMacใๆฅ็ถใใฆ่กใใพใใใใณใณใฝใผใซใซใคใใฆใฏMacใฎSafariใฎWebใคใณในใใฏใฟใไฝฟ็จใใพใใใ
SafariใฎWebใคใณในใใฏใฟใฎไฝฟ็จๆนๆณใฏใใใงใฏๅฒๆใใพใใ
-
iPhoneใฎSafariใซใฆใhoge.comใฎ parent.php ใ้ใใพใ
-
first_party_cookie in foo.com ใฎใชใณใฏใๆผใใฆใfoo.comใซ่จญ็ฝฎใใใfirst_party_cookie.php ใธ้ท็งปใใพใใ
ใชใญใผใใใใฆใCookieใใปใใใใใใฎใ็ขบ่ชใใฆใใ ใใใ
Safariใฎ็นๅพดใจใใฆใfoo.comใฎใใกใผในใใใผใใฃCookieใๅญๅจใใชใๅ ดๅใๅพใซๅฎ่กใใrequestStorageAccess()ใๅคฑๆใใฆใใพใใพใใใใฎใใไบๅใซSet-Cookieใใฆใใพใใ
backใใฟใณใงๆปใใพใใ -
parent.phpใใชใญใผใใใพใใ
ใณใณใฝใผใซใซไธ่จใฎใใใซ่กจ็คบใใใพใใ
Cookie when loading:ใฎๅพใใซไฝใใชใใฎใงใใญใผใๆใฎdocument.cookieใnullใซใชใฃใฆใใใใจใ็ขบ่ชใงใใพใใ
ๅ ใปใฉ็ขบ่ชใใ1st-party-from-serverใชใฉใฎCookieใใใตใผใใใผใใฃใงใฏใใญใใฏใใใฆใใใใใงใใ
ใพใ ใrequestStorageAccess()ใใใฆใใชใใใใhasStorageAccessใฏfalseใจใชใฃใฆใใพใใ -
callRequestStorageAccessใใฟใณใๆผใใพใใ
ไธ่จใฎใใใใขใใใ่กจ็คบใใใพใใ
่จฑๅฏใๆผใใrequestStorageAccess()ใๆๅใใๅ ดๅใฏใณใณใฝใผใซใซStorage access was grantedใจ่กจ็คบใใใพใใ
- getCookieByUserActionใใฟใณใๆผใใพใใ
ใณใณใฝใผใซใซfoo.comใฎfirst_party_cookie.phpใงSetใใCookieใ่กจ็คบใใใพใใ
ใใใงใตใผใใใผใใฃใฎdocument.cookieใๅๅพใงใใพใใใ
hasStorageAccess()ใฎ็ตๆใtrueใซใชใใพใใใ
ๆณจๆ็น
- ไบๅใซใใกใผในใใใผใใฃใงSet-Cookieใใๅฟ ่ฆใใใใ
- ใฆใผใถใธใงในใใฃใผใงใrequestStorageAccess()ใcallใใๅฟ
่ฆใใใใ
- requestStorageAccess()ใpromiseใฎcallbackใฎfunctionใซ้ ็ฝฎใใๅ ดๅใใฆใผใถใธใงในใใฃใจใฟใชใใใใๅคฑๆใใฆใใพใใฎใงๆณจๆใ
- ใใผใธใใชใญใผใใใๅ ดๅใฏใrequestStorageAccess()ใงๅๅพใใ่จฑๅฏใใชใปใใใใใฆใใพใใ
- ใใฎๅ ดๅใฏๅๅบฆใฆใผใถใธใงในใใฃใซใใrequestStorageAccess()ใcallใใๅฟ ่ฆใใใใ
- 2ๅ็ฎใฏใใใใขใใใฏ่กจ็คบใใใชใใ
ใพใจใ
ใใงใใdocument.cookieใฏๅๅพใงใใใฎใงใใใchild.php ใธใฎ้ไฟกใ่ฆใใฆใฟใใใจใใใCookieใใใใผใฏๅญๅจใใพใใใงใใใ
ใใฎใใใตใผใๅดใงใฎ$_COOKIE ใงใฎๅๅพใฏไธๅฏ่ฝใงใใใ
็พๅจใฎๅฎ่ฃ
ใใตใผใๅดใงใฎCookieๅๅพใซไพๅญใใฆใใๅ ดๅใฏใdocument.cookieใธใฎ็งป่กใฏใใผใใซใ้ซใใใงใใ
ใพใใฆใผใถใธใงในใใฃใผใๅฟ
่ฆใงใใ็นใใชใญใผใใใใจใชใปใใใใใ็นใฏใ็งป่กใไธๅฏ่ฝใซใใ่ฆ็ด ใซใชใใใใใใพใใใ
2024ๅนดๆ็นใงใฏใCHIPSใจ็ตใฟๅใใใใใจใงๆฐธ็ถ็ใชใญใฐใคใณใๅฏ่ฝใซใชใฃใฆใใพใใไธ่จใฎ่จไบใๅ็
งใใฆใใ ใใใ
https://qiita.com/reoito/items/357d0e8e63290200f0fe
Comments
Let's comment your feelings that are more than good