Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Specify what happens when partitioned cookies collide with same-name unpartitioned cookies #58

Closed
johannhof opened this issue Sep 26, 2022 · 2 comments

Comments

@johannhof
Copy link
Member

For example in browsers that have not blocked 3P cookies (yet) or when storage access is granted, we should say what the expected observable behavior is when an embedded context reads/writes a 1P cookie and a partitioned cookie with the same name. Talking to @DCtheTall I think that in Chrome it would currently store and send both cookies (i.e. the same name twice) but it would be good to have consistency and a clear definition of that.

@johannhof
Copy link
Member Author

johannhof commented Sep 26, 2022

This follows from #38 and #51 with the assumption that partitioned cookies are accessible in non-partitioned embedded contexts as defined in #42.

@DCtheTall
Copy link
Collaborator

The Algorithm section addresses this concern:

Also, we would modify the first part of step 19 of the algorithm in step 5.4 to also include the partition-key in the list of cookie attributes to check, so that two cookies with the same name, domain, host-only-flag, and path can coexist in the cookie store if their partition-key values differ.

I have merged a PR against the partitioned cookies draft spec. I brought up this solution at IETF and no one had any objections, so I am going to close this and we can hash out any details when reviewing the spec.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants