What Does Header('P3P: Cp="Cao Psa Our"'); Do

Meaning? header('P3P:CP=IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT');

P3P is the Platform for Privacy Prefences Project. It is intended to make compact privacy policy statements.

You can break down this statement based off this resource:

IDC: This is an Access descriptor. This grants access to identifiable contact information.
DSP: This is a privacy policy token concerning dispute resolution.
COR: Errors by your service will be remedied by your service.
ADM: Information can be used for technical support, without consent
DEVi: etc. etc. etc. (I'm not going to go through all of these.)

I don't know why any hacker would put that into a header, but be sure you revert the changes.

What are the implications of having a missing P3P file?

Well, pointing to a non-existent policy file is a violation of the P3P specification, which you might consider one implication. However, popular clients (including early versions of Internet Explorer) don't actually load the full policy file or take action based on its existence or contents.

Research has shown that compact policy statements like this are common (for working around IE cookie restrictions) and very frequently don't include an actual full policy file even though one is required by the spec.

What possible harm can come from setting the header: P3P: CP=CAO PSA OUR

It depends... Do you trust everyone you frame? Do you trust everyone that are framing you? Do you know that I don't frame you, and then alter the content of you page?

There is a proper HTML5 solution for this: postMessage (se e.g. http://html5demos.com/postmessage2). This lets you set up trust relationships etc.

jQuery even has a wrapper plugin that encapsulates this, and uses an #anchor trick if the browser does not support the HTML5 postMessage:

http://benalman.com/projects/jquery-postmessage-plugin/
http://plugins.jquery.com/plugin-tags/postmessage

Be security aware, don't turn off browser-enabled security features... :)

Anyone knows what the code snippet means below?

Take a look at this site for a translation of the commands:

http://www.p3pwriter.com/LRN_111.asp

Cookie blocked/not saved in IFRAME in Internet Explorer

I got it to work, but the solution is a bit complex, so bear with me.

What's happening

As it is, Internet Explorer gives lower level of trust to IFRAME pages (IE calls this "third-party" content). If the page inside the IFRAME doesn't have a Privacy Policy, its cookies are blocked (which is indicated by the eye icon in status bar, when you click on it, it shows you a list of blocked URLs).

the evil eye
_{(source: piskvor.org)}

In this case, when cookies are blocked, session identifier is not sent, and the target script throws a 'session not found' error.

(I've tried setting the session identifier into the form and loading it from POST variables. This would have worked, but for political reasons I couldn't do that.)

It is possible to make the page inside the IFRAME more trusted: if the inner page sends a P3P header with a privacy policy that is acceptable to IE, the cookies will be accepted.

How to solve it

Create a p3p policy

A good starting point is the W3C tutorial. I've gone through it, downloaded the IBM Privacy Policy Editor and there I created a representation of the privacy policy and gave it a name to reference it by (here it was policy1).

NOTE: at this point, you actually need to find out if your site has a privacy policy, and if not, create it - whether it collects user data, what kind of data, what it does with it, who has access to it, etc. You need to find this information and think about it. Just slapping together a few tags will not cut it. This step cannot be done purely in software, and may be highly political (e.g. "should we sell our click statistics?").

(e.g. "the site is operated by ACME Ltd., it uses anonymous per-session identifiers for its operation, collects user data only if explicitly permitted and only for the following purposes, the data is stored only as long as necessary, only our company has access to it, etc. etc.").

(When editing with this tool, it's possible to view errors/omissions in the policy. Also very useful is the tab "HTML Policy": at the bottom, it has a "Policy Evaluation" - a quick check if the policy will be blocked by IE's default settings)

The Editor exports to a .p3p file, which is an XML representation of the above policy. Also, it can export a "compact version" of this policy.

Link to the policy

Then a Policy Reference file (http://example.com/w3c/p3p.xml) was needed (an index of privacy policies the site uses):

<META>
  <POLICY-REFERENCES>
    <POLICY-REF about="/w3c/example-com.p3p#policy1">
      <INCLUDE>/</INCLUDE>
      <COOKIE-INCLUDE/>
    </POLICY-REF>
  </POLICY-REFERENCES>
</META>

The <INCLUDE> shows all URIs that will use this policy (in my case, the whole site). The policy file I've exported from the Editor was uploaded to http://example.com/w3c/example-com.p3p

Send the compact header with responses

I've set the webserver at example.com to send the compact header with responses, like this:

HTTP/1.1 200 OK 
P3P: policyref="/w3c/p3p.xml", CP="IDC DSP COR IVAi IVDi OUR TST"
// ... other headers and content

policyref is a relative URI to the Policy Reference file (which in turn references the privacy policies), CP is the compact policy representation. Note that the combination of P3P headers in the example may not be applicable on your specific website; your P3P headers MUST truthfully represent your own privacy policy!

Profit!

In this configuration, the Evil Eye does not appear, the cookies are saved even in the IFRAME, and the application works.

Edit: What NOT to do, unless you like defending from lawsuits

Several people have suggested "just slap some tags into your P3P header, until the Evil Eye gives up".

The tags are not only a bunch of bits, they have real world meanings, and their use gives you real world responsibilities!

For example, pretending that you never collect user data might make the browser happy, but if you actually collect user data, the P3P is conflicting with reality. Plain and simple, you are purposefully lying to your users, and that might be criminal behavior in some countries. As in, "go to jail, do not collect $200".

A few examples (see p3pwriter for the full set of tags):

NOI : "Web Site does not collected identified data." (as soon as there's any customization, a login, or any data collection (***** Analytics, anyone?), you must acknowledge it in your P3P)
STP: Information is retained to meet the stated purpose. This requires information to be discarded at the earliest time possible. Sites MUST have a retention policy that establishes a destruction time table. The retention policy MUST be included in or linked from the site's human-readable privacy policy." (so if you send STP but don't have a retention policy, you may be committing fraud. How cool is that? Not at all.)

I'm not a lawyer, but I'm not willing to go to court to see if the P3P header is really legally binding or if you can promise your users anything without actually willing to honor your promises.