Click here to Skip to main content
Click here to Skip to main content

Make Standard use of Cookie with Cookie Compact Privacy Policy (P3P)

, 14 Oct 2009
Rate this:
Please Sign up or sign in to vote.
Make Standard use of Cookie with Cookie Compact Privacy Policy (P3P)

A few days ago, our QA team was testing a web site and found a bug. So they informed me that my page is not working properly. So I went over to their desk and found that my page is not setting a cookie on the QA's PC (which is running Windows Vista). So I thought it might be some error in my code. I tried to figure it out, but I found the same page is setting a cookie on other machines. Then I thought it might be some security issue and I came to know about the Cookie Compact Privacy Policy.

What is the Cookie Compact Policy?

Cookie Compact Privacy Policy (also know as P3P) is a way to tell the browser about web sites' cookie policy. The policy describes what type of data web site is keeping in Cookie, how it's using this data, how much time it's keeping data in the cookie, etc. The cookie compact policy looks like:

IDC DSP COR CURa ADMa  OUR IND PHY ONL COM STA 

Here each group of three character word has an explanation that can be found here. To set this cookie policy, there are few options you have. You can set the cookie policy from your ASP.NET page by adding the following tag in your page's header section (usually master page).

<meta http-equiv="P3P" content='CP="IDC DSP COR CURa ADMa  OUR IND PHY ONL COM STA"'>

So all you need now is to define the cookie policy for your company. You can define the cookie policy be going through the definition from here. Be sure your cookie policy reflects your real purpose. Say you collect personal data but your cookie policy doesn't specify that then you are anyway violating cookie policy and for which you may be charged (but I'm not sure how). You can find few Compact Policy builders. With these tools, you can build P3P policy.

So now you can think if you are ever concerned about the P3P policy. If you think that users who will visit your site will be under heavy security (usually enterprise users have so) then there's a probability that your cookie without P3P Compact Policy will not work. So if you are developing your site for enterprise/business users who will use the site for business applications, then you should use Cookie Compact Policy. For web sites targeted for public users, you may not need to care for Cookie policy. But it's always better to add P3P header to ensure your cookie works under browser protected mode.

How to Find Cookie Compact Policy Related Settings in Internet Explorer?

If you go to Internet Explorer > Tools > Internet Options > Privacy, then you will find an option on how Internet Explorer will handle cookie as shown below:

image

If from any site cookie is blocked for any reason (most probably due to absence of P3P header), you will find the following icon in the IE status bar.

image

Double clicking on the red icon, you will get a full report of the blocked cookie. Clicking on the red eye, you will find a report as shown below:

image

So make best and proper use of a cookie in your site to make it most compatible with browsers.

License

This article, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

About the Author

Sohel_Rana
Architect ImpleVista Aps
Denmark Denmark
Sohel has more than six years of experience in professional software development with extensive involvement in Web based Object-Oriented, Multi-Tiered application design and development. He's Familiar with Test Driven Development (TDD) and refactoring techniques as well as having expertise in architecturing large enterprise applications. He has Experience in working with Content Management System and Portal Management System tools like SharePoint, DotNetNuke, Ektron.
 
Over last few years, he’s involved in development with projects on Microsoft SharePoint and received Microsoft MVP for SharePoint Server Development in the year 2011 and 2012. Currently he's working in a software company located Copenhagen,Denmark on a project integrating SharePoint and SAP. You can read his popular blog at: http://ranaictiu-technicalblog.blogspot.com

Comments and Discussions

 
-- There are no messages in this forum --
| Advertise | Privacy | Mobile
Web02 | 2.8.140709.1 | Last Updated 15 Oct 2009
Article Copyright 2009 by Sohel_Rana
Everything else Copyright © CodeProject, 1999-2014
Terms of Service
Layout: fixed | fluid