Hacker News Reader

I just tested this and it's simply not true. Cookie headers to an iframe from a third-party domain are suppressed when third-party cookie blocking is on, and sent when cookie blocking is off.

Google whitelists their own third-party cookies by default in Chrome and it's possible other browsers come with a preset whitelist as well, maybe that's what you encountered.

View on HN

You're probably right -- I can't create a reproducible test case now. Still, given the browser fingerprinting, you're best off blocking the HTTP connection.

Citation for the whitelist claim?

There was an exception for Google in my cookie whitelist that I didn't put there, but after checking some other chrome installs it isn't on all of them.

Reply on news.ycombinator.com