reading my own domain cookies as a third party

Question

I am going crazy at the moment, I have been spending a day on something that should take nothing.

I am doing the following on my compoundjs site (on the server)

   var cookie = req.cookies.my_user;
   if(!cookie){
       console.log("not user");
       res.cookie('my_user',  user._id, {maxAge: 900000, httpOnly: false });
   }

I am running the site as localhost:3000

When I run the following bookmarklet from some page I do not control

var link = document.createElement("link");
link.type = "text/css";
link.rel = "stylesheet";
link.href =  "//localhost:3000/bookmarklet/bookmarklet.css";
var head = document.getElementsByTagName("head"); 
head[0].appendChild(link);
var script = document.createElement('script');
script.src = "//localhost:3000/bookmarklet/bookmarklet.js";
head[0].appendChild(script);

and inside of bookmarklet.js I do

console.log(document.cookie);

I do not have the cookie I set.

Obviously I should have access because the script is being served from the same domain as my cookie is being set.

I go look at an actual html document being served from that page and open up the console and do console.log(document.cookie) I see my cookie, but not if I execute inside of the javascript being written into the document.

In other words it is behaving as though it were a session cookie I set, even though it should not be as I understand it.

Answer 1

I think the way you set the cookie must be a problem ... I advise you to use cookies libraries just like this one (if you're already working with jQuery), so that you can set the cookie like this :

$.setCookie("key","value",7); // expires in one week
Cookie = $.getCookie("key"); // it gets you cookie
$.removeCookie("key"); // to remove your cookie

and you have many other options to do with cookies like get all cookies or clear all cookies and so on ...

Answer 2

Obviously I should have access because the script is being served from the same domain as my cookie is being set.

Perhaps not so obvious. Scripts run with the permissions of the page that they are loaded by, not the location that they were loaded from. That is, the domain that a script is being served from is irrelevant — the only location that matters is the one in the browser's location bar (or the notional location bar, if it's a frame).