I got it to work, but the solution is a bit complex, so bear with me.
What's happening
As it is, Internet Explorer gives lower level of trust to IFRAME pages (IE calls this "third-party" content). If the page inside the IFRAME doesn't have a Privacy Policy, its cookies are blocked (which is indicated by the eye icon in status bar, when you click on it, it shows you a list of blocked URLs).
(source: piskvor.org)
In this case, when cookies are blocked, session identifier is not sent, and the target script throws a 'session not found' error.
(I've tried setting the session identifier into the form and loading it from POST variables. This would have worked, but for political reasons I couldn't do that.)
It is possible to make the page inside the IFRAME more trusted: if the inner page sends a P3P header with a privacy policy that is acceptable to IE, the cookies will be accepted.
How to solve it
Create a p3p policy
A good starting point is the W3C tutorial. I've gone through it, downloaded the IBM Privacy Policy Editor and there I created a representation of the privacy policy and gave it a name to reference it by (here it was policy1).
NOTE: at this point, you actually need to find out if your site has a privacy policy, and if not, create it - whether it collects user data, what kind of data, what it does with it, who has access to it, etc. You need to find this information and think about it. Just slapping together a few tags will not cut it. This step cannot be done purely in software, and may be highly political (e.g. "should we sell our click statistics?").
(e.g. "the site is operated by ACME Ltd., it uses anonymous per-session identifiers for its operation, collects user data only if explicitly permitted and only for the following purposes, the data is stored only as long as necessary, only our company has access to it, etc. etc.").
(When editing with this tool, it's possible to view errors/omissions in the policy. Also very useful is the tab "HTML Policy": at the bottom, it has a "Policy Evaluation" - a quick check if the policy will be blocked by IE's default settings)
The Editor exports to a .p3p file, which is an XML representation of the above policy. Also, it can export a "compact version" of this policy.
Link to the policy
Then a Policy Reference file (http://example.com/w3c/p3p.xml) was needed (an index of privacy policies the site uses):
<META>
<POLICY-REFERENCES>
<POLICY-REF about="/w3c/example-com.p3p#policy1">
<INCLUDE>/</INCLUDE>
<COOKIE-INCLUDE/>
</POLICY-REF>
</POLICY-REFERENCES>
</META>
The <INCLUDE> shows all URIs that will use this policy (in my case, the whole site). The policy file I've exported from the Editor was uploaded to http://example.com/w3c/example-com.p3p
Send the compact header with responses
I've set the webserver at example.com to send the compact header with responses, like this:
HTTP/1.1 200 OK
P3P: policyref="/w3c/p3p.xml", CP="IDC DSP COR IVAi IVDi OUR TST"
// ... other headers and content
policyref is a relative URI to the Policy Reference file (which in turn references the privacy policies), CP is the compact policy representation. Note that the combination of P3P headers in the example may not be applicable on your specific website; your P3P headers MUST truthfully represent your own privacy policy!
Profit!
In this configuration, the Evil Eye does not appear, the cookies are saved even in the IFRAME, and the application works.
Edit: What NOT to do, unless you like defending from lawsuits
Several people have suggested "just slap some tags into your P3P header, until the Evil Eye gives up".
The tags are not only a bunch of bits, they have real world meanings, and their use gives you real world responsibilities!
For example, pretending that you never collect user data might make the browser happy, but if you actually collect user data, the P3P is conflicting with reality. Plain and simple, you are purposefully lying to your users, and that might be criminal behavior in some countries. As in, "go to jail, do not collect $200".
A few examples (see p3pwriter for the full set of tags):
- NOI : "Web Site does not collected identified data." (as soon as there's any customization, a login, or any data collection (***** Analytics, anyone?), you must acknowledge it in your P3P)
- STP: Information is retained to meet the stated purpose. This requires information to be discarded at the earliest time possible. Sites MUST have a retention policy that establishes a destruction time table. The retention policy MUST be included in or linked from the site's human-readable privacy policy." (so if you send
STP but don't have a retention policy, you may be committing fraud. How cool is that? Not at all.)
I'm not a lawyer, but I'm not willing to go to court to see if the P3P header is really legally binding or if you can promise your users anything without actually willing to honor your promises.
Best Answer
you have 2 ways:
by group policy editor or by editing the windows registry:
Method #1: Using Group Policy Editor
Using Group Policy Editor is probably the best method, because it can be used either locally, on one computer, or in an Active Directory environment by utilizing the GPO power.
Press Start button + R (the Run command), type gpedit.msc and press Enter to launch the Group Policy Editor. Note: In an Active Directory environment, open gpmc.msc and either edit an existing GPO, or create a new one and link it to the domain level, or to an OU of your choice.
In the left pane, expand User Configuration > Administrative Templates > Windows Components > Internet Explorer.
On the right pane, double-click on “Prevent running First Run wizard". A new settings window will open up.
Set the value to “Enabled”.
•Go directly to “Welcome To IE” page •Go directly to home page
You need to choose one of the two, otherwise the configuration will not work. The first option configures IE to skip the Welcome screen and go directly to your home page, whatever it is.
The second option configures IE to skip the Welcome screen and and go to the “Welcome to Internet Explorer” page directly.
Click Apply to save the settings then click OK and close the Group Policy Editor window.
Press Start button + R (the Run command) and type gpupdate /force and press Enter to refresh the Group Policy on the computer.
Method #2: Using Registry Editor
You can use this method to either manually configure one computer, or generate a .REG file to import it on other machines. Warning:
This document contains instructions for editing the registry. If you make any error while editing the registry, you can potentially cause Windows to fail or be unable to boot, requiring you to reinstall Windows. Edit the registry at your own risk. Always back up the registry before making any changes. If you do not feel comfortable editing the registry, do not attempt these instructions. Instead, seek the help of a trained computer specialist.
Press Start button + R to open run command dialog box. Type regedit and press Enter to open the Registry Editor. You may be prompted with a UAC prompt, click "Yes".
Navigate to the following path: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Main Note: The above branch does not exist by default, and has to be created manually, or by running the .REG file available at the end of this article.
Right click on the right pane and select New > DWORD (32-bit) Value.
Enter DisableFirstRunCustomize.
Right-click on the new entry it and choose “Modify”.
Exit the Registry Editor.
Note: You can use this .REG file to import the same setting to your computer: Windows Registry Editor Version 5.00
;Disable IE11 Welcome Screen
[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Main]
"DisableFirstRunCustomize"=dword:00000001
Copy the above text into a new text file, and save it as "DisableIEWelcome.reg".
Taken from here : https://mkcheah88.blogspot.co.il/2014/06/microsoft-how-to-disable-internet.html