Frames, Sessions, and P3P

Introduction

A while ago, I encountered a problem resulting from the inability of session variables to be available cross-domain, specifically when using Frames.

Background

This problem occurs when you have a web page which contains a frame(s) whose source location is cross domain,or resides on a separate server.

Using the code

After some research, I found that a solution to this problem would be to add/modify the necessary HTTP headers programmatically.

Adding an HTTP header would need to occur before any page HTML is added. The best way to do this would be by an external module where we can add our header at the very beginning of the application request. Since this problem was apparent on a number of our applications, this would be ideal as we could also re-use this module.

Let's create a module that would add the required header for us. First, create a new Class Library project. Let's call it ApplicationModule. Now, add a new class to our ApplicationModule project called Application.cs. Implement the interface IHttpModule. We now create a private method OnStartOfApplication that does the addition of the required header to solve our problem. This method will be called on application initialization via the Application Init method.

public class ModuleRuss : IHttpModule
{
#region IHttpModule Members

     public void Dispose()
     {
     }

     public void Init(HttpApplication context)
     {
          context.BeginRequest += (new EventHandler(this.OnStartOfApplication ));
     }

#endregion

     private void OnStartOfApplication (Object source, EventArgs e)
     {
          HttpContext.Current.Response.AddHeader("p3p", 
            "CP=\"IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT\"");
     }
}

So, how do we get this to work in our Web Application?

First, we need to add a reference to our ApplicationModule.dll in our Web Project. We then need to reference our newly added ApplicationModule in our Web.Config file within the <httpModules> section:

<add name="externalModule" type="ApplicationModule.Application, ApplicationModule"/>

Points of interest

So now, using Fiddler or IE Watch, you can view your Response Headers and see that you have a new entry for P3P. This helped solve my problem; hope it helps solve yours.