← Back to IM18+ Home

Cookie Mechanics Explained

How Cross-Domain Cookies Work

The IM18+ system uses a simple but effective cookie-based approach for federated age verification. Here's how it works technically:

Single Cookie Approach

  • • Cookie Name: age_verified
  • • Value: true (when verified)
  • • Domain: .im18.app
  • • SameSite: Lax
  • • Secure: true (HTTPS only)
  • • Expires: 30 days from verification

Verification Flow

Step 1: Partner Site Check

Partner site includes iframe pointing to verify.im18.app

<iframe src="https://verify.im18.app/api/check-anonymous.php"></iframe>

Step 2: Cookie Detection

Iframe checks for age_verified cookie on im18.app domain

$verified = isset($_COOKIE['age_verified']) && $_COOKIE['age_verified'] === 'true';

Step 3: PostMessage Communication

Result sent to parent via postMessage API

parent.postMessage({verified: true, source: 'im18plus'}, '*');

Security Features

Domain Isolation

Cookies set on .im18.app domain only, preventing partner sites from manipulating verification status

HTTPS Only

Secure flag ensures cookies only transmitted over encrypted connections

SameSite Protection

Lax setting prevents CSRF attacks while allowing legitimate cross-site usage

Automatic Expiry

30-day expiration ensures periodic re-verification

Implementation Example

<?php
// Partner site integration
echo '<iframe id="age-check" src="https://verify.im18.app/api/check-anonymous.php" style="display:none;"></iframe>';
?>

<script>
window.addEventListener('message', function(event) {
    if (event.origin === 'https://verify.im18.app') {
        if (event.data.verified === true) {
            // User is verified - show content
            document.getElementById('adult-content').style.display = 'block';
        } else {
            // Show verification form
            window.open('https://verify.im18.app/verify.php', '_blank');
        }
    }
});
</script>

🔒 Privacy Note

No personal information is stored in cookies. The system only tracks verification status, not identity or personal details.