Troubleshooting P3P : Basic principles

Troubleshooting P3P may sometimes be very frustrating. There are thousands of mail messages that are posted on the www-p3p-policy mailing list from the webmasters that are working on enabling P3P on their web-sites, but have run into difficulties. In some cases, people simply do not understand the way P3P works, but in other cases the webmasters have partially enabled P3P, but with some details not right.

The first thing that must be done, after enabling P3P on your site, would be to check it, to ensure that this implementation is correct. W3C’s P3P Validator is an excellent tool for doing this. Used with at least one P3P user agent, it’s the best way a developer is able to test a P3P site.

The P3P Validator is used for checking the syntactic correctness and the proper placement of the P3P files on your web-server. In the case that the Validator reports any errors, you must read them carefully and solve them one at a time until you get no errors. Also, you should check the list of the known P3P validator bugs and see if there are some of them that may be applied to your site. If the server is configured to send P3P headers, you have to make sure that those headers are really being emitted. The validator report will contain the information whether are the P3P headers received from your site.

After validating the site, you must check how it works with a P3P user agent. Of course, it would be better if there would be done some tests on all the available user agents that the visitors of the web-site might be using. The most used agents are Microsoft’s Internet Explorer, Netscape and the AT&T Privacy Bird. You must check whether all the clients are able to produce a human readable report about your P3P server, and if the reports correspond to your privacy policy. If you have encoded your policy in XML, this would be a good way to check for errors. Also, after making changes to your policy, it would be the best to clean the browser’s cache, in order to always get the updated information.