javascript - How Does a Facebook Widget Installed on Different Domains Know I'm Logged into Facebook.com? -


this question has answer here:

if log facebook.com , in tab log domain x.com, uses facebook widget, how facebook widget installed on x.com know i'm logged facebook , not require re-authentication use it?

it seems x.com script able read cookie created under facebook.com , defies consensus cookies can't read across domains. how facebook circumventing consensus?

most of time, widgets talking <iframe> (or <object>) tags. so, seeing part of facebook real domain on page. facebook page have access of facebook cookies, can recognize , log on.

it impossible "x.com" have access cookies obvious security reasons.


Comments