Situation:
I am a HTML newbie who gets by through Google-fu and I am in charge of a tool which sends HTML email to customers.
I have been asked by our customers (Because pressing reply and typing a single word is really difficult) if I can create buttons on the emails I send which allows them a 1-click reply.
Conditions:
The reply has to come from their own email address
It needs to go back to the email address that sent the email (We have one template email which can be sent from several addresses)
It needs to maintain the same subject line (It contains a reference number to ensure the email is processed correctly when received)
Must be created using inline HTML(4 or 5) only (Restrictions of the system that generates the email)
Ideally will send the reply immediately (And show them as much in some manner), but opening up a new email already pre-populated is an acceptable alternative
I have struggled to find much at all on this, which leads me to think that it is not possible.
If using tiny bit of pure javascript, that does not need any external library on your website.
This code goes to your website where you want your check to be made.
<script>
function getURLParameter(name) {
return decodeURIComponent((new RegExp('[?|&]' + name + '=' + '([^&;]+?)(&|#|;|$)').exec(location.search) || [null, ''])[1].replace(/\+/g, '%20')) || null;
}
document.addEventListener("DOMContentLoaded", function(event) {
if(getURLParameter('answ') == 0) document.getElementById('answered_yes').remove();
else if(getURLParameter('answ') == 1) document.getElementById('answered_no').remove();
else {
document.getElementById('answered_yes').remove(); document.getElementById('answered_no').remove();
}
});
</script>
<div id="answered_yes">
THIS IS HOLDER FOR YES ANSWERER //Put your wanted info hare if he answered yes
</div>
<div id="answered_no">
THIS IS HOLDER FOR NO ANSWERER //Put your wanted info hare if he answered no
</div>
Now on email links put these type of links.
<a href="yourwebsite.com/index.php?answ=0" target="_blank" >ANSWER NO</a>
<a href="yourwebsite.com/index.php?answ=1" target="_blank" >ANSWER YES</a>
What this does is simply puts a parameter on a link called answ that has 0 or 1 by my setting and once your website gets a request it checks which parameter is it 0 or 1. If its 0 that means we remove the div that says yes, otherwise do the same with no div.
with only html it is not possible unless you would give him different links as in.
<a href="yoursite.com/he_answered_no.html" >No</a>
<a href="yoursite.com/he_answered_yes.html" >Yes</a>
And put your contents inside there.
However if you are going to use this script in your website, put that code somewhere in the body, its not perfect, but it will do the job. Then put your information on yes div and on no div, its going to remove whatever div he answers too.
But like I mentioned, with purely HTML it is not possible only adding some bits with other languages, pure javascript should work on any HTML site, unless you are trying to add the code to some kind of platform that blocks any ongoing scripts.
You can just use a "mailto:" link similar to this:
Email Us
Here's the link with more info: https://css-tricks.com/snippets/html/mailto-links/
It will open up a prepopulated email with the "to" address, subject line, and body text already inserted. People will be able to modify the text if they want or just click send. You would need to some way to dynamically change the subject line to the one the customer received, but your email tool probably has that capability.
I have two websites, let's say they're example.com and anotherexample.net.
On anotherexample.net/page.html, I have an IFRAME SRC="http://example.com/someform.asp". That IFRAME displays a form for the user to fill out and submit to http://example.com/process.asp. When I open the form ("someform.asp") in its own browser window, all works well.
However, when I load someform.asp as an IFRAME in IE 6 or IE 7, the cookies for example.com are not saved. In Firefox this problem doesn't appear.
For testing purposes, I've created a similar setup on http://newmoon.wz.cz/test/page.php .
example.com uses cookie-based sessions (and there's nothing I can do about that), so without cookies, process.asp won't execute. How do I force IE to save those cookies?
Results of sniffing the HTTP traffic: on GET /someform.asp response, there's a valid per-session Set-Cookie header (e.g. Set-Cookie: ASPKSJIUIUGF=JKHJUHVGFYTTYFY), but on POST /process.asp request, there is no Cookie header at all.
Edit3: some AJAX+serverside scripting is apparently capable to sidestep the problem, but that looks very much like a bug, plus it opens a whole new set of security holes. I don't want my applications to use a combination of bug+security hole just because it's easy.
Edit: the P3P policy was the root cause, full explanation below.
I got it to work, but the solution is a bit complex, so bear with me.
What's happening
As it is, Internet Explorer gives lower level of trust to IFRAME pages (IE calls this "third-party" content). If the page inside the IFRAME doesn't have a Privacy Policy, its cookies are blocked (which is indicated by the eye icon in status bar, when you click on it, it shows you a list of blocked URLs).
(source: piskvor.org)
In this case, when cookies are blocked, session identifier is not sent, and the target script throws a 'session not found' error.
(I've tried setting the session identifier into the form and loading it from POST variables. This would have worked, but for political reasons I couldn't do that.)
It is possible to make the page inside the IFRAME more trusted: if the inner page sends a P3P header with a privacy policy that is acceptable to IE, the cookies will be accepted.
How to solve it
Create a p3p policy
A good starting point is the W3C tutorial. I've gone through it, downloaded the IBM Privacy Policy Editor and there I created a representation of the privacy policy and gave it a name to reference it by (here it was policy1).
NOTE: at this point, you actually need to find out if your site has a privacy policy, and if not, create it - whether it collects user data, what kind of data, what it does with it, who has access to it, etc. You need to find this information and think about it. Just slapping together a few tags will not cut it. This step cannot be done purely in software, and may be highly political (e.g. "should we sell our click statistics?").
(e.g. "the site is operated by ACME Ltd., it uses anonymous per-session identifiers for its operation, collects user data only if explicitly permitted and only for the following purposes, the data is stored only as long as necessary, only our company has access to it, etc. etc.").
(When editing with this tool, it's possible to view errors/omissions in the policy. Also very useful is the tab "HTML Policy": at the bottom, it has a "Policy Evaluation" - a quick check if the policy will be blocked by IE's default settings)
The Editor exports to a .p3p file, which is an XML representation of the above policy. Also, it can export a "compact version" of this policy.
Link to the policy
Then a Policy Reference file (http://example.com/w3c/p3p.xml) was needed (an index of privacy policies the site uses):
<META>
<POLICY-REFERENCES>
<POLICY-REF about="/w3c/example-com.p3p#policy1">
<INCLUDE>/</INCLUDE>
<COOKIE-INCLUDE/>
</POLICY-REF>
</POLICY-REFERENCES>
</META>
The <INCLUDE> shows all URIs that will use this policy (in my case, the whole site). The policy file I've exported from the Editor was uploaded to http://example.com/w3c/example-com.p3p
Send the compact header with responses
I've set the webserver at example.com to send the compact header with responses, like this:
HTTP/1.1 200 OK
P3P: policyref="/w3c/p3p.xml", CP="IDC DSP COR IVAi IVDi OUR TST"
// ... other headers and content
policyref is a relative URI to the Policy Reference file (which in turn references the privacy policies), CP is the compact policy representation. Note that the combination of P3P headers in the example may not be applicable on your specific website; your P3P headers MUST truthfully represent your own privacy policy!
Profit!
In this configuration, the Evil Eye does not appear, the cookies are saved even in the IFRAME, and the application works.
Edit: What NOT to do, unless you like defending from lawsuits
Several people have suggested "just slap some tags into your P3P header, until the Evil Eye gives up".
The tags are not only a bunch of bits, they have real world meanings, and their use gives you real world responsibilities!
For example, pretending that you never collect user data might make the browser happy, but if you actually collect user data, the P3P is conflicting with reality. Plain and simple, you are purposefully lying to your users, and that might be criminal behavior in some countries. As in, "go to jail, do not collect $200".
A few examples (see p3pwriter for the full set of tags):
NOI : "Web Site does not collected identified data." (as soon as there's any customization, a login, or any data collection (***** Analytics, anyone?), you must acknowledge it in your P3P)
STP: Information is retained to meet the stated purpose. This requires information to be discarded at the earliest time possible. Sites MUST have a retention policy that establishes a destruction time table. The retention policy MUST be included in or linked from the site's human-readable privacy policy." (so if you send STP but don't have a retention policy, you may be committing fraud. How cool is that? Not at all.)
I'm not a lawyer, but I'm not willing to go to court to see if the P3P header is really legally binding or if you can promise your users anything without actually willing to honor your promises.
I've spend a large part of my day looking into this P3P thing and I feel the need to share what I've found out.
I've noticed that the P3P concept is very outdated and seems only to be really used/enforced by Internet Explorer (IE).
The simplest explanation is: IE wants you to define a P3P header if you are using cookies.
This is a nice idea, and luckily most of the time not providing this header won't cause any issues (read browser warnings). Unless your website/web application is loaded into an other website using an (i)Frame. This is where IE becomes a massive pain in the ***. It will not allow you to set a cookie unless the P3P header is set.
Knowing this I wanted to find an answer to the following two questions:
Who cares? In other words, can I be sued if I put the word "Potato" in the header?
What do other companies do?
My findings are:
No one cares. I'm unable to find a single document that suggests this technology has any legal weight. During my research I didn't find a single country around the world that has adopted a law that prevents you from putting the word "Potato" in the P3P header
Both Google and Facebook put a link in their P3P header field referring to a page describing why they don't have a P3P header.
The concept was born in 2002 and it baffles me that this outdated and legally unimplemented concept is still forced upon developers within IE.
If this header doesn't have have any legal ramifications this header should be ignored (or alternatively, generate a warning or notification in the console). Not enforced! I'm now forced to put a line in my code (and send a header to the client) that does absolutely nothing.
In short - to keep IE happy - add the following line to your PHP code (Other languages should look similar)
header('P3P: CP="Potato"');
Problem solved, and IE is happy with this potato.
I was able to make the evil eye go away by simply adding this small header to the site in the IFrame (PHP solution):
header('P3P: CP="NOI ADM DEV COM NAV OUR STP"');
Remember to press ctrl+F5 to reload your site or Explorer may still show the evil eye, despite the fact that it's working fine. This is probably the main reason why I had so many problems getting it to work.
No policy file was neccesary at all.
Edit:
I found a nice blog entry that explains the problem with cookies in IFrames. It also has a quick fix in C# code:
Frames, ASPX Pages and Rejected Cookies
This is buried in the comments of other answers, but I almost missed it, so it seems like it deserves its own answer.
To review: in order for IE to accept 3rd party cookies, you need serve your files with an http header called p3p in the format:
CP="my compact p3p policy"
BUT, p3p is pretty much dead as a standard at this point and you can easily get IE to work without investing the time and legal resources in creating a real p3p policy. This is because if your compact p3p policy header is invalid, IE actually treats it as a good policy and accepts 3rd party cookies. So you can use a p3p header such as this
CP="This site does not have a p3p policy."
You can optionally include a link to a page that explains why you don't have a p3p policy, as Google and Facebook do (they point here: https://support.google.com/accounts/answer/151657 and here: https://www.facebook.com/help/327993273962160/).
Finally, it's important to note that all files served from the 3rd party site need to have the p3p header, not just the one that sets the cookie, so you may not be able to just do this in your PHP, asp.net, etc code. You are probably better off setting in up on the web server level (i.e. in IIS or Apache).
I had this issue as well, thought I'd post the code that I used in my MVC2 project. Be careful when in the page life cycle you add in the header or you'll get an HttpException "Server cannot append header after HTTP headers have been sent." I used a custom ActionFilterAttribute on the OnActionExecuting method (called before the action is executed).
/// <summary>
/// Privacy Preferences Project (P3P) serve a compact policy (a "p3p" HTTP header) for all requests
/// P3P provides a standard way for Web sites to communicate about their practices around the collection,
/// use, and distribution of personal information. It's a machine-readable privacy policy that can be
/// automatically fetched and viewed by users, and it can be tailored to fit your company's specific policies.
/// </summary>
/// <remarks>
/// More info http://www.oreillynet.com/lpt/a/1554
/// </remarks>
public class P3PAttribute : ActionFilterAttribute
{
/// <summary>
/// On Action Executing add a compact policy "p3p" HTTP header
/// </summary>
/// <param name="filterContext"></param>
public override void OnActionExecuting(ActionExecutingContext filterContext)
{
HttpContext.Current.Response.AddHeader("p3p","CP=\"IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT\"");
base.OnActionExecuting(filterContext);
}
}
Example use:
[P3P]
public class HomeController : Controller
{
public ActionResult Index()
{
ViewData["Message"] = "Welcome!";
return View();
}
public ActionResult About()
{
return View();
}
}
This is a great topic on the issue, however I found that one important detail (which was essential at least in my case) that was not posted here or anywhere else (I apologize if I just missed it) was that the P3P line must be passed in header of EVERY file sent from the 3rd party server, even files not setting or using the cookies such as Javascript files or images. Otherwise the cookies will be blocked. I have more on this in a post here: http://posheika.net/?p=110
Anyone having this problem in node.js.
Then add this p3p module, and enable this module at middleware.
npm install p3p
I am using express so I add it in app.js
First require that module in app.js
var express = require('express');
var app = express();
var p3p = require('p3p');
then use it as middleware
app.use(p3p(p3p.recommended));
It will add p3p headers at res object. No need to do any extra things.
You will get more info at:
https://github.com/troygoode/node-p3p
If anybody is looking for Apache line; we used this one.
Header set P3P "CP=\"Thanks IE8\""
It really didn't matter what we set CP value to, as long as there is the P3P header.
One possible thing to do is to add the domain to allowed sites in tools -> internet options -> privacy -> sites: somedomain.com -> allow -> OK.
This post provides some commentary on P3P and a short-cut solution that reduces the problems with IE7 and IE8.
One solution that I haven't seen mentioned here, is using session storage instead of cookies.
Of course this might not fit everyone's requirements, but for some cases it's an easy fix.
I was investigating this problem with regard to login-off via Azure Access Control Services, and wasn't able to connect head and tails of anything.
Then, stumbled over this post https://blogs.msdn.microsoft.com/ieinternals/2011/03/10/beware-cookie-sharing-in-cross-zone-scenarios/
In short, IE doesn't share cookies across zones (eg. Internet vs. Trusted sites).
So, if your IFrame target and html page are in different zone's P3P won't help with anything.
Got similar problem, also went to investigate how to generate the P3P policy this morning, here is my post about how to generate your own policy and use in the web site :)
http://everydayopenslikeaflower.blogspot.com/2009/08/how-to-create-p3p-policy-and-implement.html
I've implemented a full P3P policy before but didn't want go through the hassle again for a new project I was working on. I found this link useful for a simple solution to the problem, only having to specify a minimal compact P3P policy of "CAO PSA OUR":
http://blog.sweetxml.org/2007/10/minimal-p3p-compact-policy-suggestion.html
The article quotes a (now broken) link to a Microsoft kb article. The policy did the trick for me!
You can also combine the p3p.xml and policy.xml files as such:
/home/ubuntu/sites/shared/w3c/p3p.xml
<META xmlns="http://www.w3.org/2002/01/P3Pv1">
<POLICY-REFERENCES>
<POLICY-REF about="#policy1">
<INCLUDE>/</INCLUDE>
<COOKIE-INCLUDE/>
</POLICY-REF>
</POLICY-REFERENCES>
<POLICIES>
<POLICY discuri="" name="policy1">
<ENTITY>
<DATA-GROUP>
<DATA ref="#business.name"></DATA>
<DATA ref="#business.contact-info.online.email"></DATA>
</DATA-GROUP>
</ENTITY>
<ACCESS>
<nonident/>
</ACCESS>
<!-- if the site has a dispute resolution procedure that it follows, a DISPUTES-GROUP should be included here -->
<STATEMENT>
<PURPOSE>
<current/>
<admin/>
<develop/>
</PURPOSE>
<RECIPIENT>
<ours/>
</RECIPIENT>
<RETENTION>
<indefinitely/>
</RETENTION>
<DATA-GROUP>
<DATA ref="#dynamic.clickstream"/>
<DATA ref="#dynamic.http"/>
</DATA-GROUP>
</STATEMENT>
</POLICY>
</POLICIES>
</META>
I found the easiest way to add a header is proxy through Apache and use mod_headers, as such:
<VirtualHost *:80>
ServerName mydomain.com
DocumentRoot /home/ubuntu/sites/shared/w3c/
ProxyRequests off
ProxyPass /w3c/ !
ProxyPass / http://127.0.0.1:8080/
ProxyPassReverse / http://127.0.0.1:8080/
ProxyPreserveHost on
Header add p3p 'P3P:policyref="/w3c/p3p.xml", CP="NID DSP ALL COR"'
</VirtualHost>
So we proxy all requests except those to /w3c/p3p.xml to our application server.
You can test it all with the W3C validator
If you own the domain that needs to be embedded, then you could, before calling the page that includes the IFrame, redirect to that domain, which will create the cookie and redirect back,
as explained here: http://www.mendoweb.be/blog/internet-explorer-safari-third-party-cookie-problem/
This will work for Internet Explorer but for Safari as well (because Safari also blocks the third-party cookies).
I know it's a bit late to put my contribution on this subject but I lost so many hours that maybe this answer will help somebody.
I was trying to call a third party cookie on my site and of course it was not working on Internet Explorer 10, even at a low security level... don't ask me why. In the iframe I was calling a read_cookie.php (echo $_COOKIE) with ajax.
And I don't know why I was incapable of setting the P3P policy to solve the problem...
During my search I saw something about getting the cookie in JSON working. I don't even try because I thought that if the cookie won't pass through an iframe, it will not pass any more through an array...
Guess what, it does! So if you json_encode your cookie then decode after your ajax request, you'll get it!
Maybe there is something I missed and if I did, all my apologies, but i never saw something so stupid. Block third party cookies for security, why not, but let it pass if encoded? Where is the security now?
I hope this post will help somebody and again, if I missed something and I'm dumb, please educate me!
This finally worked for me (after a lot of hastle and generating some policies using IBMs policy generator). You can downlod the policy generator here: http://www.softpedia.com/get/Security/Security-Related/P3P-Policy-Editor.shtml
I was not able to download the generator from the official IBM website any more.
I created these files in the root folder of my Web-App
/index.php
/w3c/policy.html (Human readable format)
/w3c/p3p.xml
/w3c/policy.p3p
Index.php: Just send an additional header:
header('P3P: policyref="/w3c/p3p.xml", CP="ALL DSP NID CURa ADMa DEVa HISa OTPa OUR NOR NAV DEM"');
Content of p3p.xml
<META>
<POLICY-REFERENCES>
<POLICY-REF about="/w3c/policy.p3p#App">
<INCLUDE>/</INCLUDE>
<COOKIE-INCLUDE/>
</POLICY-REF>
</POLICY-REFERENCES>
</META>
Content of my policy.html file
<html>
<head>
<STYLE type="text/css">
title { color: #3333FF}
</STYLE>
<title>Privacy Statement for YOUR COMPANY NAME</title>
</head>
<body>
<h1 class="title">Privacy Policy</h1>
<!-- "About Us" section of privacy policy -->
<h2>About Us</h2>
<p>This is a privacy policy for YOUR COMPANY NAME.
Our homepage on the Web is located at <a href="YOURWEBSITE">
YOURWEBSITE</a>.
The full text of our privacy policy is available on the Web at
<a href="ABSOLUTE URL OF THIS FILE">
ABSOLUTE URL OF THIS FILE</a>
This policy does not tell users where they can go to exercise their opt-in or opt-out options.
<p>We invite you to contact us if you have questions about this policy.
You may contact us by mail at the following address:
<pre>FIRSTNAME LASTNAME
YOUR ADDRESS HERE
</pre>
<p>You may contact us by e-mail at
<a href="mailto:info#YOURMAIL.de">
info#YOURMAIL.eu</a>.
You may call us at TELEPHONENUMBER.
<!-- "Privacy Seals" section of privacy policy -->
<h2>Dispute Resolution and Privacy Seals</h2>
<p>We have the following privacy seals and/or dispute resolution mechanisms.
If you think we have not followed our privacy policy in some way, they can help you resolve your concern.
<ul>
<li>
<b>Dispute</b>:
Contact us for further information
</ul>
<!-- "Additional information" section of privacy policy -->
<h2>Additional Information</h2>
<p>
This policy is valid for 1 day from the time that it is loaded by a client.
</p>
<!-- "Data Collection" section of privacy policy -->
<h2>Data Collection</h2>
<p>P3P policies declare the data they collect in groups (also referred to as "statements").
This policy contains 1 data group.
<hr width="50%" align="center">
<h3>Group "App control data"</h3>
<p>We collect the following information:
<ul>
<li>HTTP cookies</li>
</ul>
<p>This data will be used for the following purposes:</p>
<ul>
<li>Completion and support of the current activity.</li>
<li>Web site and system administration.</li>
<li>Research and development.</li>
<li>Historical preservation.</li>
<li>Other purposes<p>Control Flow of the application</p></li>
</ul>
<p>This data will be used by ourselves and our agents.
<p>The data in this group has been marked as non-identifiable. This means that there is no
reasonable way for the site to identify the individual person this data was collected from.
<p>The following explanation is provided for why this data is collected:</p>
<blockquote>This cookie data is only used to control the application within an iframe (e.g. a Facebook App)</blockquote>
<!-- "Use of Cookies" section of privacy policy -->
<hr width="50%" align="center">
<h2>Cookies</h2>
<p>Cookies are a technology which can be used to provide you with tailored information from a Web site. A cookie is an element of data that a Web site can send to your browser, which may then store it on your system. You can set your browser to notify you when you receive a cookie, giving you the chance to decide whether to accept it.
<p>Our site makes use of cookies.
Cookies are used for the following purposes:
<ul>
<li>Site administration
<li>Completing the user's current activity
<li>Research and development
<li>Other
(Control Flow of the application)
</ul>
<!-- "Compact Policy Explanation" section of privacy policy -->
<hr width="50%" align="center">
<h2>Compact Policy Summary</h2>
<p>The compact policy which corresponds to this policy is:
<pre>
CP="ALL DSP NID CURa ADMa DEVa HISa OTPa OUR NOR NAV"
</pre>
<p>The following table explains the meaning of each field in the compact policy.
<center><table width="80%" border="1" cols="2">
<tr><td align="center" valign="top" width="20%"><b>Field</b></td><td align="center" valign="top" width="80%"><b>Meaning</b></td></tr>
<tr><td align="left" valign="top" width="20%"><tt>CP=</tt></td>
<td align="left" valign="top" width="80%">This is the compact policy header; it indicates that what follows is a P3P compact policy.</td></tr>
<tr><td align="left" valign="top" width="20%"><tt>ALL</tt></td>
<td align="left" valign="top" width="80%">
Access to all collected information is available.
</td></tr>
<tr><td align="left" valign="top" width="20%"><tt>DSP</tt></td>
<td align="left" valign="top" width="80%">
The policy contains at least one dispute-resolution mechanism.
</td></tr>
<tr><td align="left" valign="top" width="20%"><tt>NID</tt></td>
<td align="left" valign="top" width="80%">
The information collected is not personally identifiable.
</td></tr>
<tr><td align="left" valign="top" width="20%"><tt>CURa</tt></td>
<td align="left" valign="top" width="80%">
The data is used for completion of the current activity.
</td></tr>
<tr><td align="left" valign="top" width="20%"><tt>ADMa</tt></td>
<td align="left" valign="top" width="80%">
The data is used for site administration.
</td></tr>
<tr><td align="left" valign="top" width="20%"><tt>DEVa</tt></td>
<td align="left" valign="top" width="80%">
The data is used for research and development.
</td></tr>
<tr><td align="left" valign="top" width="20%"><tt>HISa</tt></td>
<td align="left" valign="top" width="80%">
The data is used for historical archival purposes.
</td></tr>
<tr><td align="left" valign="top" width="20%"><tt>OTPa</tt></td>
<td align="left" valign="top" width="80%">
The data is used for other purposes.
</td></tr>
<tr><td align="left" valign="top" width="20%"><tt>OUR</tt></td>
<td align="left" valign="top" width="80%">
The data is given to ourselves and our agents.
</td></tr>
<tr><td align="left" valign="top" width="20%"><tt>NOR</tt></td>
<td align="left" valign="top" width="80%">
The data is not kept beyond the current transaction.
</td></tr>
<tr><td align="left" valign="top" width="20%"><tt>NAV</tt></td>
<td align="left" valign="top" width="80%">
Navigation and clickstream data is collected.
</td></tr>
</table></center>
<p>The compact policy is sent by the Web server along with the cookies it describes.
For more information, see the P3P deployment guide at http://www.w3.org/TR/p3pdeployment.
<!-- "Policy Evaluation" section of privacy policy -->
<hr width="50%" align="center">
<h2>Policy Evaluation</h2>
<p>Microsoft Internet Explorer 6 will evaluate this policy's compact policy whenever it is used with a cookie.
The actions IE will take depend on what privacy level the user has selected in their browser (Low, Medium, Medium High, or High; the default is Medium.
In addition, IE will examine whether the cookie's policy is considered satisfactory or unsatisfactory, whether the cookie is a session cookie or a persistent cookie, and whether the cookie is used in a first-party or third-party context.
This section will attempt to evaluate this policy's compact policy against Microsoft's stated behavior for IE6.
<p><b>Note:</b> this evaluation is currently experimental and should not be considered a substitute for testing with a real Web browser.
<p><b>Satisfactory policy</b>: this compact policy is considered <em>satisfactory</em> according to the rules defined by Internet Explorer 6.
IE6 will accept cookies accompanied by this policy under the High, Medium High, Medium, Low, and Accept All Cookies settings.
</body></html>
Content of policy.p3p
<?xml version="1.0"?>
<POLICIES xmlns="http://www.w3.org/2002/01/P3Pv1">
<!-- Generated by IBM P3P Policy Editor version Beta 1.12 built 2/27/04 1:19 PM -->
<!-- Expiry information for this policy -->
<EXPIRY max-age="86400"/>
<POLICY
name="App"
discuri="ABSOLUTE URL TO policy.html"
xml:lang="de">
<!-- Description of the entity making this policy statement. -->
<ENTITY>
<DATA-GROUP>
<DATA ref="#business.name">COMPANY NAME</DATA>
<DATA ref="#business.contact-info.online.email">info#YOURMAIL.eu</DATA>
<DATA ref="#business.contact-info.online.uri">YOURWEBSITE</DATA>
<DATA ref="#business.contact-info.telecom.telephone.number">YOURPHONENUMBER</DATA>
<DATA ref="#business.contact-info.postal.organization">FIRSTNAME LASTNAME</DATA>
<DATA ref="#business.contact-info.postal.street">STREET</DATA>
<DATA ref="#business.contact-info.postal.city">CITY</DATA>
<DATA ref="#business.contact-info.postal.stateprov">STAGE</DATA>
<DATA ref="#business.contact-info.postal.postalcode">POSTALCODE</DATA>
<DATA ref="#business.contact-info.postal.country">Germany</DATA>
</DATA-GROUP>
</ENTITY>
<!-- Disclosure -->
<ACCESS><all/></ACCESS>
<!-- Disputes -->
<DISPUTES-GROUP>
<DISPUTES resolution-type="service" service="YOURWEBSITE CONTACT FORM" short-description="Dispute">
<LONG-DESCRIPTION>Contact us for further information</LONG-DESCRIPTION>
<!-- No remedies specified -->
</DISPUTES>
</DISPUTES-GROUP>
<!-- Statement for group "App control data" -->
<STATEMENT>
<EXTENSION optional="yes">
<GROUP-INFO xmlns="http://www.software.ibm.com/P3P/editor/extension-1.0.html" name="App control data"/>
</EXTENSION>
<!-- Consequence -->
<CONSEQUENCE>
This cookie data is only used to control the application within an iframe (e.g. a Facebook App)</CONSEQUENCE>
<!-- Data in this statement is marked as being non-identifiable -->
<NON-IDENTIFIABLE/>
<!-- Use (purpose) -->
<PURPOSE><admin/><current/><develop/><historical/><other-purpose>Control Flow of the application</other-purpose></PURPOSE>
<!-- Recipients -->
<RECIPIENT><ours/></RECIPIENT>
<!-- Retention -->
<RETENTION><no-retention/></RETENTION>
<!-- Base dataschema elements. -->
<DATA-GROUP>
<DATA ref="#dynamic.cookies"><CATEGORIES><navigation/></CATEGORIES></DATA>
</DATA-GROUP>
</STATEMENT>
<!-- End of policy -->
</POLICY>
</POLICIES>
In Rails I am using this gem : https://github.com/merchii/rack-iframe
Bawically it sets a set of abbreviations without a reference file: https://github.com/merchii/rack-iframe/blob/master/lib/rack/iframe.rb#L8
It is easy to install when you dont care at all about the meaning of the p3p stuff.
For anyone trying to get the P3P Compact Policy working with static content:
It is only possible if you are able to send custom server-side response headers with the static content.
For a more detailed explanation see my answer here: Set P3P code in HTML
In Rails 3.2 I am using:
class ApplicationController < ActionController::Base
before_filter :set_p3p
private
# for IE session cookies thru iframe
def set_p3p
headers['P3P'] = 'CP="ALL DSP COR CURa ADMa DEVa OUR IND COM NAV"'
end
end
I got this from: http://dot-net-web-developer-bristol.blogspot.com/2012/04/setting-p3p-header-in-rails-session.html
A better solution would be to make an Ajax call inside the iframe to the page that would get/set cookies...
I've used ColdFusion for sending text emails for years. I'm now interested in learning how to send those pretty emails you see from companies like Mint.
Anyone know of a good ColdFusion tutorial to teach me how to make this work and not get hit by bugs or spam filters?
As Ray said, ColdFusion supports HTML email, which is how you make an email "pretty". A quick down and dirty sample looks like this:
<cfmail from="bob#bob.com" to="someguy#email.com" subject="Check this out!" type="HTML">
<HTML>
<head><title>My Email</title>
</head>
<body>
<!--- Style Tag in the Body, not Head, for Email --->
<style type="text/css">
body { font-size: 14px; }
</style>
This is the text of my email.
</body>
</HTML>
</cfmail>
That's it, you've just sent an email. Notice how there is nothing preventing you from sticking in any old from email address you like? That leads me to my next point, in which you're wondering how to avoid getting hit by Spam filters:
The short answer is: You can't.
Oh sure, you can do intelligent things, like not including the word "VIAGRA" in your email (unless you're trying to send out penile enlargement emails and want to know how to get past spam filters, in which case I'm disinclined to help), but let's assume you just want to avoid obvious pitfalls.
I can think of two things that might help:
Send out email from a domain registered to the from email address. I didn't make the rules, but this one can be a pain. Ie., If you try to send out proxy emails for myorg.com, and your server does not host myorg.com, some spam filters are going to block it. What is usually done is to apply some branding to the from email, like this:
<cfmail from="MyOrg.Com <DONOTREPLY#registeredsite.com>" replyto="bob#myorg.com" to="someguy#email.com" subject="Test" type="HTML">
</cfmail>
In this case the email is sent from your server at registeredsite.com, with a replyto being the proxy email address. Spam filters will probably be okay with this, since the from email address of *#registeredsite.com resolves to your server. Try to send out with bob#myorg.com in the from, and you'll definitely run into some places that will block you.
Use a physical server, not a cloud site. I'm running into this very issue right now, but if you don't use a physical server that is located at a dedicated IP to send out your email, and if this server is not the originator of the email, some places are going to block it. This means no EC2 or Rackspace cloud site--sorry, some sysadmins are inclined to put down the banhammer on anything that originates from one of these providers, seeing as it is so easy to churn up your own little spam factory using EC2 or Rackspace for very little cost.
Even if you take these precautions, however, you'll run into a situation where someone gets a hold of your domain name and drags it through the mud. They'll send out thousands of emails to the internet in your name--or rather, in your domain's name--and because of the insecurity of email, your domain will get added to someone's blacklist after a thousand occurrences of hotlove4u#registeredsite.com hit the sysadmin's inbox. There's nothing you can do about it, either.
Or you can decide to run a cloud app and use a remote mail server. But some jokers will get one look at the originator being EC2 and will say, "Nope, sorry. Denied." They don't care about the legitimacy of your organization, only the origin of the email.
Email is an antiquated technology that has been rushed into mass usage before we really were able to think of a better protocol. As a protocol, it's terrible....and yet we're stuck with it, for backwards compatibility reasons. You cannot possibly avoid the spam filter. 95% of the email on the internet is junk mail, and never even reaches the intended recipient. Just absorb the enormity of that statistic for a moment, and pull your ideas back to reality. Many of the spam-prevention techniques being used today are unnecessarily aggressive, and create a great many 'false positives'. You can shoot for, say 80% of your email being sent, but what it really comes down to is this: As soon as the email has been fired off, it's completely out of your control. You can only take responsibility for so much.
What do you mean by "pretty" - HTML based? CF supports html email. Just use type="html". You can also use cfmailpart to send both text and html versions of the same content.
Here's a good article on making HTML email using CSS:
http://articles.sitepoint.com/article/code-html-email-newsletters
Ray's answer is right on the money about the CF part, but most of making this work is about HTML, CSS and testing testing testing.
And I would add to this all that you can check whether a mail will be displayed correctly and whether it will get hit by a spamfilter or not by going to a website that is called litmusapp. You can send your test newsletter to one of their emailaddresses and then they will give you screenshots of how each newsletter will look like in each type of emailclient. Also it checks the newsletter against a few popular spamblockers and gives you advice on what to change.
I would start by finding an HTML template email that you like. Then you put it in the tags with the type set to html as mentioned above. You might want to consider doing the multipart email to handle plaintext (and blackberry) users.
I subscribe to the Campaign Monitor Newsletter & they also have a list of very useful articles here: http://www.campaignmonitor.com/resources/
Might want to check out this ebook from MailChimp. Email apps render HTML in some unusual ways, so be prepared to use tables for layout.
Remember when you try to change the color of the font or background when you writing a cfmail, before you add #F0000, you need to ad extra # at the front of it, like ##F0000. Otherwise, it will cause an error.