Thread

Hi ladies and gentlemen,

So I’m building this Facebook app running on EE. At some point in the app, users need to log in to an EE account. Works fine in every browser, except for IE.

My facebook app runs inside an iframe (Facebook page tab), and this seems to be the problem. I’ve made a super simple template for testing with a normal exp:member:login_form, which returns to itself:

{if logged_in}
 Hi {screen_name}!
 {/if}
 {exp:member:login_form return="start/login"}
                 <label>Username</label>

                 <input type="text" name="username" value="" maxlength="32" size="25">
                 <label>Password</label>

                 <input type="password" name="password" value="" maxlength="32" size="25">
         <input type="submit" name="submit" value="Submit"></p>
 {/exp:member:login_form}

Obviously, this login form works perfectly fine when not in an iframe. However, when inside an iframe, the login form simply returns to itself, but doesn’t display “Hi {screen_name}”, indicating that EE thinks you’re not logged in. I think the iframe is not allowed to set a session id by Internet Explorer.

When I target the login form directly (outside of an iframe), log in, and then refresh the iframed login page, it suddenly does recognize the user.

What should I do to allow the iframed login form to actually log a user in? And why is it that any browser works fine, except for IE?

Thanks a lot!

Okay, so I’ve continued to Google for about half a decade and everything is pointing towards P3P headers: I need to send a P3P header (and policy) from the iframed page so that Internet Explorer trusts its cookies.

Now the problem is: I can’t. Well - I can send the header from the page with the login form, but then the redirects don’t send the header meaning the cookie is blocked anyway.

So; new question: how can I make sure the P3P headers are sent from the redirect pages as well? I tried sending them from the Design > User messages template, but this doesn’t allow PHP.

Is there a way I can make sure *any* page generated by EE sends the P3P headers?