Catching "Failed to read the 'cookie' property from 'Document'"

If the script is executed inside an iframe with a sandbox attribute, it can throw an error:

Stack: Error: Failed to read the ‘cookie’ property from ‘Document’: The document is sandboxed and lacks the ‘allow-same-origin’ flag.

test.html

<iframe src="iframe.html" sandbox="allow-scripts"></iframe>

Script inside iframe.html sufficient to reproduce the error:

document.cookie;

Possible solution: replace this check in get and set functions:

if (typeof document === 'undefined') {
  return;
}

by this:

try { document.cookie; } catch (e) { return; }

Issue Analytics

State:
Created 4 years ago
Reactions:2
Comments:8 (3 by maintainers)

Top GitHub Comments

4reactions

bigb06commented, Jul 19, 2021

I’m having quite the same error but no iframe here: Failed to read the ‘cookie’ property from ‘Document’ : Access is denied for this document

It happens only on chrome and I can’t reproduce the problem : disable cookies, privacy sandbox, … I just log error since few days and it happens on chrome 91.x with android 8 to 11.

1reaction

carhartlcommented, Sep 9, 2019

Why would you execute/load the script when having explicitly sandboxed the iframe and thus expecting it to not work?

Asked differently: if we were to catch the error and swallow it silently, how would a developer know that she had accidentally sandboxed the iframe?