can't access cookie when page is iframed by shopify

Question

I am running node v6.9.1 and i have a simple server running using [email protected]

I can set a cookie at route /cookies/set with the following code:

server.route({
    method: 'GET',
    path: '/cookies/set',
    config: {
        handler: (request: hapi.Request, reply: hapi.IReply) => {
            reply('cookie set').state('data', JSON.stringify({
                hasCookie: true
            }));
        }
    }
});

And retrieving the cookie at /cookies/get with the following code:

server.route({
    method: 'GET',
    path: '/cookies/get',
    config: {
        state: {
            parse: true,
            failAction: 'error'
        },
        handler: (request: hapi.Request, reply: hapi.IReply) => {
            reply({
                cookie: request.state
            })
        }
    }
});

This works fine when browsing locally. I setup another server running on a different port, with an index.html which iframes the cookie demo.

The iframe src is pointing to http://localhost:9500/cookies/set and then using dev tools, i redirect the iframe to /cookies/get and all is working fine - i can see the the hasCookie: true being returned.

I then setup a shopify embedded app which after authenticating with OAuth, redirects to /cookies/set and i get the response 'cookie set'

Again using dev tools, i redirect the frame to /cookies/get but this time the cookie is blank?

I'm getting no console errors or anything on shopify, and no errors on my side either. I've even got localhost running on https to make sure it wasn't some weird thing to do with framing a http page inside a https page.

Why can't i access the cookie? Why is it behaving differently than when i setup a different server and mimicked shopify's setup? (localhost:8000 is a different domain to localhost:9500, just like shopify.com is different to localhost)

I've tried numerous cookie/session libraries etc to no avail.

I've enabled 3rd party cookies.

I'm not doing any weird cross domain stuff - the iframed page is stand alone and doesn't need to know anything about the parent page.

I also tried having /cookies/get return a simple http page which makes an XHR request to /cookies/get2 (same code) and that didn't work either.

Answer 1

Would it make any sense that Shopify strips your cookies and there is nothing you can do about it?