Why do we have to modify default IE cookie settings here?

[Guest]

Hello, friends,

We developed a web site using asp.net 1.1 and Form Authentication. It works
ok.

However, when our users log into our website through internet, it requires
users to reset their IE cookie settings. For example, for IE 6.0 users, a
user will have to

(1) Click on Tools/Internet Options...,

(2) Go to Privacy tab,

(3) Click on Advanced button,

(4) Check "Override automatic cookie handling" so that IE will accept
First-party Cookies and Third-party Cookies.

This procedure is really annoying to our users.

And, to my knowledge, a lot of websites use cookies but do not require users
to reset their IE cookie settings.

Anything I did wrong? Any ideas? Is there a way to stop this? Thanks a lot.

(Our web site uses another port, not port 80, for http. Will this cause the
problem?)

 

[George Ter-Saakov]

The first party cookies are enabled by default so you do not need to reset
that.
If you planting third-party cookies meaning that they come from different
domain than the page's url shown in address bar then you need to implement
PCP
Privacy compact policy.
Basically page that sets cookie must add to the header something like that.
P3P:CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"


Done with a single line of code
Response.AddHeader("P3P", "CP=\"CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL
UNI COM NAV INT DEM PRE\"");

Does not matter what you make CP equal to. As long as it's something.

If you want to read more about PCP then good luck
http://msdn.microsoft.com/workshop/security/privacy/overview/createprivacypolicy.asp



George.

 

[Guest]

Hi, George, thanks, and let me try.

The first party cookies are enabled by default so you do not need to reset
that.
If you planting third-party cookies meaning that they come from different
domain than the page's url shown in address bar then you need to implement
PCP
Privacy compact policy.
Basically page that sets cookie must add to the header something like that.
P3P:CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"


Done with a single line of code
Response.AddHeader("P3P", "CP=\"CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL
UNI COM NAV INT DEM PRE\"");

Does not matter what you make CP equal to. As long as it's something.

If you want to read more about PCP then good luck
http://msdn.microsoft.com/workshop/security/privacy/overview/createprivacypolicy.asp



George.