`Partioned` attribute missing in `Cookie`

[mkurz]

Cookie does not store if a Partioned attribute is set.

It can be implemented just like the secure flag with a simple boolean.

It's needed for the "Cookies Having Independent Partitioned State" (CHIPS) feature, which all browsers support already.
More details here: https://developers.google.com/privacy-sandbox/cookies/chips

Thanks!

PS: Regarding browser support if you interested:

• Supported already by Chrome/Edge according to https://caniuse.com/mdn-http_headers_set-cookie_partitioned
  • Data seems to be incomplete however, see next points
• In Firefox since v131: https://www.mozilla.org/en-US/firefox/131.0/releasenotes/#note-790397
• Coming to Safari 18.4 (https://developer.apple.com/documentation/safari-release-notes/safari-18_4-release-notes#Networking)

[yschimke]

I'm a little concerned it's an expired draft https://datatracker.ietf.org/doc/draft-cutler-httpbis-partitioned-cookies/

Are there any precedents in non browser user agents? I don't think Curl implements it. Nor Python requests.

defining a new attribute, Partitioned, which restricts the contexts in which a cookie is available to only those whose top-level document is same-site with the top-level document that initiated the request that created the cookie. These cookies are referred to as "partitioned cookies" and allow embedded sites which are cross-site with the top-level frame to have access to HTTP state which cannot be used for tracking across multiple top-level sites.

This concept doesn't seem to apply to a HTTP library. Or is it enough to decode Partitioned and treat it as ignored so cookies do work?

[ihostage]

Hi, @yschimke 👋

This concept doesn't seem to apply to a HTTP library. Or is it enough to decode Partitioned and treat it as ignored so cookies do work?

I personally think that decoding the Partitioned attribute is sufficient to provide information for users of this library. HTTP libraries are not only used for business logic of applications but also frequently for writing integration tests. For example, without information from the HTTP library about all cookie attributes, it's impossible to check whether the web application behaves correctly. 🤷‍♂

[yschimke]

Yeah, it seems reasonable to support parsing and exposing this value

[mkurz]

Here a real world use case where we had to work around the missing Partioned attribute in Cookie:
https://github.com/playframework/playframework/blob/c1db787bd326b7081524a82c4b3f550f825ec729/core/play-integration-test/src/test/scala/play/it/http/FlashCookieSpec.scala#L193-L194