Menu
Community /Pin to ProfileBookmark
@NogDogOct 13.2022 — #That iframe and different domain stuff is going to be a problem with the session cookies, due to how latest versions of most browsers now actively prevent exchange of 3rd-party cookies and such. I had to change some stuff on a legacy app some time ago, but don't recall specifically what I did; but looks like this article might do a decent job of explaining the issue and maybe will point you in the right direction: https://web.dev/samesite-cookies-explained/
SESSION not being generated for all users
I have some measures in place to block bots or malicious users from abusing my booking form as follows:
1. Add their IP address into the form on the first page and then on page 2, read it into the SESSION.2. When they process payment, check their IP address against the one in the SESSION to validate they have gone through the process and not just a bot POSTing directly to the process payment page – IF no IP found, redirect back to first page3. Each time the process payment page is requested, increment the IP address counter and if they reach 5 attempts – Add their IP address to blacklist and also add their email to bannedEmails list
This works ok BUT I have noticed that legitimate users are also being blocked because no SESSION is present.
I have the form sitting on domain1.com and it is loaded into an iframe over the wordpress site.
I have two other websites – domain2.com and domain3.com which both load the same form from domain1.com into an iframe over their respective websites but I found that chrome wont allow SESSIONs to be created cross site so users were getting blocked so now, I just open the booking page directly from each of these sites into a new browser window.
This seemed to fix the problem in testing BUT some SESSIONS are still not being loaded.
Why is the SESSION on randomly generated and how can I either force the SESSION or use an alternate method of validation.
Sign in
to post a comment2 Comments(s) ↴
0
@NogDogOct 13.2022 — #That iframe and different domain stuff is going to be a problem with the session cookies, due to how latest versions of most browsers now actively prevent exchange of 3rd-party cookies and such. I had to change some stuff on a legacy app some time ago, but don't recall specifically what I did; but looks like this article might do a decent job of explaining the issue and maybe will point you in the right direction: