Why doesn't disabling Third Party Cookies block authentication sites, LiveID, OpenID, etc.

Trying to not make this political, but I need to explain my motivation to assist those who may answer this.

I had been watching the Google/Verizon anti-net neutrality power grab for awhile. Unhappy with their announcement I've decided it was time to not reward Google by passively opting into their data mining efforts.

My assumption was that switching search engines and turning off Third Party Cookies would be a good step.

What confuses me is that authentication sites like LiveID, OpenID, etc still work. Can someone explain why this is the case? I would have thought that as they're different domains it wouldn't work.


For openID cookie usage is up to the relying party. In general, it works like this:

  1. User submits URL to OpenID relying party
  2. Relying party checks URL for OpenID information
  3. Relying party detects Authenticating party, informs party that user wishes to authenticate.
  4. Authenticating party checks if user is authenticated (cookies: authenticating site checks their own cookies).

If the user is logged in, the relying site may issue their own cookies under their own domain.

If the user is not logged in:

  1. The user is forwarded to the Authenticating party's login page
  2. If the user logs in successfully, the Authenticating party sets any cookies they need to and informs the relying party that the user is authenticated.
  3. The relying party sets any cookies they need to and allows the user in.

Note the lack of any 3rd party cookies in any of this. It is my understanding that LiveID works in much the same way, with the LiveID authentication servers informing the 3rd party site that the user is successfully logged in and who they're logged in as, which allows the 3rd party server to interact with the user as if they'd logged in locally.

  • Thank you. So far so good. Doesn't really seem like I've lost any functionality by blocking third-party cookies. – user12491 Aug 11 '10 at 22:47
  • It's a common enough setting that sites that need to use them have figured out that an embedded IFRAME from the right site is all they need to use. – SysAdmin1138 Aug 12 '10 at 3:20

I think those sites use CERTIFICATES and shared credentials, not cookies. You can read more here.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.