# Need to pass cookie information to a child iFrame - Are there any security concerns?

I have a child iframe in my page that will load content from a different web application in a different virtual directory than the parent page.

The DOM will look roughly like this:

<html>
<!-- Content from www.contoso.com/WebApp1/Home -->
<div id="parentDiv" />
<iframe>
<!-- Content from www.contoso.com/WebApp2/Home -->
<div id="childDiv" />
</iframe>
</html>

1. The user will log in to www.contoso.com/WebApp1.
2. The user will load www.contoso.com/WebApp1/Home which contains an iframe with content from www.contoso.com/WebApp2/Home.
3. To load content from www.contoso.com/WebApp2/Home the user must be logged in.

My Question:

• Could I simply load the iframe with src=www.contoso.com/WebApp2/Home?sessionId={sessionIdFromTheParentCookie}, and write server-side code to trust the incoming sessionId and set a cookie for the child iframe?
• At present, I can't see how this is any worse than the reality that a user could tamper with his/her client-side cookie an insert an arbitrary sessionId in it.
• The sessionId must always be validated at the server, so what's the harm in supplying an arbitrary sessionId in the query string and asking the server to set the cookie?
-
I thought that cookies were shareable across an entire domain, unless you explicitly set the path when creating the cookie. Any cookies set when the user logs in should be available to the parent page and the iframe. This question on SO seems to support my notion: stackoverflow.com/questions/6578334/same-domain-iframe-cookies. Did I miss something? –  Tag Dec 20 '12 at 1:36
@Tag: Yes, thank you. –  Jim G. Dec 20 '12 at 1:43