Archive for the ‘rails’ Category

Don’t use iframe with cookie (session) setting serverscripts

Today we ran into an issue with our movie tracker at (click on ‘Star in your own condom movie’).

We use Rails3 as backend and the app is embedded with an iframe. Rails generates an auth token, which is validated when the user wants to upload the movie data.

The issue is about the users security settings. If the user does not allow third party cookies to be set, the backend fails to validate the auth token. So the conclusion is, not to use sessions with iframes. Make sure the user visit your site directly, so the session data is not third party.

Categories: rails, security