3rd party cookie, in the context of a web page, is where the web page directs the web brows to load content, such as an image, from another web server. Any cookies attached to that included content are considered 3rd party.

What your portal is doing is actually proxying. The browser sees the cookie coming from your portal. Also, it's possible the cookie has encoded the IP address of your portal in it, so the secure website might reject the cookie because the web browser's IP address won't match the IP address encoded in the cookie.

What you need to do is make the web browser always access the secure website through your portal. One way to do this would be to enhance your portal to re-write the URLs in the responses from the secure server so that they refer to the portal. Then the portal needs to forward further requests from the browser to the secure site. There are several http proxy examples on CPAN.

Alternately, your company's IT dept can redirect requests for the secure website to your portal. Of course, your portal will still have to properly forward requests and responses.

A site that would include the client's IP address in the cookie would be unusable to quite a few. There is no guarantee that your requests always come from the same IP address if you are behind a firewall. Been there, got bitten.

Jenda
Enoch was right!
Enjoy the last years of Rome.

You can set cookie in JavaScript so your Perl script could, once it gets the cookie, add a tiny snippet of JavaScript to the HTML it forwards to the users and the JavaScript would set the cookie within the clients' browser.

Thanks anon

I think I would still have problems with the cookie, as the form would be on the users PC and the server controlling the logon would be looking for the cookie it had already set in the first stages of the logon. Unfortunately that would not be on the PC but in my LWP cookie jar.

I wonder if hidden iframe pointing to (the start page of?) the logon server would work. Then the browser would send request to the server (asking for the iframe's content), and the server would send a cookie along with the document. And then Javascript would submit the form.

That's in theory. I've personally never done that before. If you'll get this working, be so kind and let us know! I for one am really curious. BTW, it does look like a good way to steal other peoples passwords :)

Thanks for these suggestions, they are interesting ideas. I will try and find the time to run some tests. If anything works I'll post it hear for future reference.

Cheers