javascript - Can a 3rd party js script write cookies?

Question

Is it possible for a 3rd party script to write cookies to the user's computer?

For example, if affiliate.example.org includes:

<script type="text/javascript" src="http://me.example.com/cookiemonster.js"></script>

I want to provide an affiliate with a script, to hopefully write a cookie on their clients' machines; ideally we would want to control the script ourselves. However, before trying this, I just thought I would see if it is even possible.

Of course, the other option would be for us to provide the actual script for the affiliate to put directly onto their site.

Answer 1

Yes, third party scripts can write cookies, and they will appear to belong to the domain of the page itself.

You can see this if you examine the cookies of any site using Google Analytics - the content comes from a third party (Google) but the _utm prefix cookies will be on the hosting site's domain.

To write third-party cookies (i.e. where the cookie is on the domain of the third party) requires that the cookies be sent in the headers of a download from that third party, and not written by JS code.