title: How does Facebook set cross-domain cookies for iFrames on canvas pages?
body: <p>I was browsing Facebook's documentation reading about canvas applications and I came across an example application: <a href="http://developers.facebook.com/docs/samples/canvas" rel="noreferrer">http://developers.facebook.com/docs/samples/canvas</a>. As I read through their example, however, I got very confused about their use of cookies in the iframe application.</p>
  
  <p>A little backstory...</p>
  
  <p>I had already played around with using iframes for embeddable widgets (unrelated to Facebook) and I found out a few browsers (Chrome, Safari, etc.) have strict cookie policies and don't allow cross-domain cookies set in iframes (Firefox, on the other hand, allows iframes to set cross-domain cookies in iframes). For example, if foo.com has an iframe with <code>src="http://bar.com/widget"</code> the iframe widget will not be able to set any cookies for bar.com and therefore will have trouble persisting state within the iframe: bar.com will interpret every request (including ajax requests) from the widget as a fresh request without an established session. I struggled, and found a way around this by using JSONP and javascript to set cookies for foo.com instead...</p>
  
  <p>... and so?</p>
  
  <p>Well, I was looking at the example canvas iframe Facebook application and I noticed that their application (hosted on runwithfriends.appspot.com) is able to set a cookie, <code>u</code>, with the current user's id along with a few other parameters for the runwithfriends.appspot.com domain. It sends this cookie with every request... and it works in both Chrome and Firefox! WTF? How does Facebook get around the cross-domain cookie restrictions on Chrome?</p>
  
  <p>(I already know the answer now, but I thought this might be helpful for anyone struggling to figure out the same thing -- I'll post the answer below.)</p>