Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:122028
Message-ID: <76dc625a-0e45-4377-bfff-2aba5244acae@gmail.com>
Date: Sun, 24 Dec 2023 12:46:40 +0100
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Content-Language: en-US
To: PHP internals <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
Subject: Partitioned cookies
From: dossche.niels@gmail.com (Niels Dossche)

Hi internals

I opened a PR [1] to implement Partitioned cookie support, as requested on the bugtracker [2], into the setcookie() PHP function. This is done by adding an option to the $options array, not via an additional argument to the function. The amount of code to support this is tiny.

This cookie option is being pushed by browser vendors (primarily by Google it seems) to eliminate third-party cookies [3, 4]. One of the impacts here is that cookies marked with "SameSite=None; Secured" without "Partitioned" will stop working eventually during 2024.

Although the Partitioned cookie proposal is still a draft, Chrome will apply the change starting in January 2024 for a tiny percentage of users (as a form of A/B testing it seems). Symfony has already implemented support for this option as well [5].
The SameSite option was also added in PHP when it was still in a draft.

Let me know what you think and if you are okay / objecting to merging this PR.

Kind regards
Niels

[1] https://github.com/php/php-src/pull/12652
[2] https://github.com/php/php-src/issues/12646
[3] https://developers.google.com/privacy-sandbox/3pcd
[4] https://developer.mozilla.org/en-US/docs/Web/Privacy/Partitioned_cookies
[5] https://github.com/symfony/symfony/pull/52002