Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:122030
Date: Sun, 24 Dec 2023 17:04:07 +0100
To: internals@lists.php.net, Niels Dossche <dossche.niels@gmail.com>,
 PHP internals <internals@lists.php.net>
User-Agent: K-9 Mail for Android
In-Reply-To: <76dc625a-0e45-4377-bfff-2aba5244acae@gmail.com>
References: <76dc625a-0e45-4377-bfff-2aba5244acae@gmail.com>
Message-ID: <50E720CC-29B0-46E6-8581-C5A549DEDA44@php.net>
MIME-Version: 1.0
Content-Type: text/plain;
 charset=utf-8
Content-Transfer-Encoding: quoted-printable
Subject: Re: [PHP-DEV] Partitioned cookies
From: derick@php.net (Derick Rethans)

On 24 December 2023 12:46:40 CET, Niels Dossche <dossche=2Eniels@gmail=2Eco=
m> wrote:
>Hi internals
>
>I opened a PR [1] to implement Partitioned cookie support, as requested o=
n the bugtracker [2], into the setcookie() PHP function=2E This is done by =
adding an option to the $options array, not via an additional argument to t=
he function=2E The amount of code to support this is tiny=2E
>
>This cookie option is being pushed by browser vendors (primarily by Googl=
e it seems) to eliminate third-party cookies [3, 4]=2E One of the impacts h=
ere is that cookies marked with "SameSite=3DNone; Secured" without "Partiti=
oned" will stop working eventually during 2024=2E
>
>Although the Partitioned cookie proposal is still a draft, Chrome will ap=
ply the change starting in January 2024 for a tiny percentage of users (as =
a form of A/B testing it seems)=2E Symfony has already implemented support =
for this option as well [5]=2E
>The SameSite option was also added in PHP when it was still in a draft=2E
>
>Let me know what you think and if you are okay / objecting to merging thi=
s PR=2E


I've two concerns (none with the PR, as I haven't checked):

- Compatibility: https://developer=2Emozilla=2Eorg/en-US/docs/Web/Privacy/=
Partitioned_cookies#browser_compatibility
- What happens if it just stays a draft, or doesn't get accepted, or with =
a different name?

And also, would/should the PHP function enforce that this should only be s=
et if for example Secure is set too? And if so, with a warning or TypeError=
?

cheers
Derick