Third-party cookie handling

izacks

I would like to ask about the handling of third party cookies.
For example this Vivaldi forum. Behavior when rejecting receipt of third party cookie.

I can login with Firefox, but I can't login with Vivaldi. Handling Firefox's third party cookie, handling on Vivaldi. Which is the correct behavior of these?

*I use only Mac and Windows version, so I don't know other platforms.

Ayespy

@izacks For Vivaldi, the correct handling is to permit 3rd party cookies on both Vivaldi.net and Vivaldi.com

izacks

@ayespy

This behavior isn't limited to this forum. I understood that this behavior is normal in Vivaldi.
In the Web world, is Firefox's behavior, Vivaldi's behavior, both are correct?

Ayespy

@izacks There is no "normal." some browsers automatically accept 3rd party cookies and don't tell you. Some browsers require that you consciously permit the acceptance of 3rd party cookies. ANY browser using the setting "accept all" will automatically accept the necessary cookies on this forum, including Vivaldi. If you have 3rd party cookies excluded in Firefox, it should not allow you to "cross-sign-in" between forum and blog. That would be improper. If you exclude 3rd party cookies, the behavior in all browsers should be the same. If you allow them, the behavior in all browsers should be the same. But the key is in whether the browser offers you the choice.

izacks

@ayespy I'm sorry, I don't understand.
Though Firefox rejects third party cookies, I can log in to this Vivaldi Forum. This is a bug/problem of Firefox. Is this correct in recognition?

Ayespy

@izacks It may claim to be rejecting 3rd party cookies but under the current schema it's not, unless you are accessing EVERYTHING currently on vivaldi.net and none on vivaldi.com (which I think may now be possible.) It is not, or should not be, possible to log in on two linked domains unless cookies from both are accepted. It is a security vulnerability to do so. It is just possible, I suppose, that firefox is treating them as un-connected domains, which it should not - as they cross-reference each other.