Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:122032
Message-ID: <5b5f8e4e-c3e3-4f0c-9425-3b784f4a4a09@gmail.com>
Date: Sun, 24 Dec 2023 23:10:57 +0100
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Content-Language: en-US
To: internals@lists.php.net
References: <76dc625a-0e45-4377-bfff-2aba5244acae@gmail.com>
 <50E720CC-29B0-46E6-8581-C5A549DEDA44@php.net>
In-Reply-To: <50E720CC-29B0-46E6-8581-C5A549DEDA44@php.net>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] Partitioned cookies
From: dossche.niels@gmail.com (Niels Dossche)

Hi

On 24/12/2023 17:04, Derick Rethans wrote:
> On 24 December 2023 12:46:40 CET, Niels Dossche <dossche.niels@gmail.com> wrote:
>> Hi internals
>>
>> I opened a PR [1] to implement Partitioned cookie support, as requested on the bugtracker [2], into the setcookie() PHP function. This is done by adding an option to the $options array, not via an additional argument to the function. The amount of code to support this is tiny.
>>
>> This cookie option is being pushed by browser vendors (primarily by Google it seems) to eliminate third-party cookies [3, 4]. One of the impacts here is that cookies marked with "SameSite=None; Secured" without "Partitioned" will stop working eventually during 2024.
>>
>> Although the Partitioned cookie proposal is still a draft, Chrome will apply the change starting in January 2024 for a tiny percentage of users (as a form of A/B testing it seems). Symfony has already implemented support for this option as well [5].
>> The SameSite option was also added in PHP when it was still in a draft.
>>
>> Let me know what you think and if you are okay / objecting to merging this PR.
> 
> 
> I've two concerns (none with the PR, as I haven't checked):
> 
> - Compatibility: https://developer.mozilla.org/en-US/docs/Web/Privacy/Partitioned_cookies#browser_compatibility

Right, indeed it is only supported by Blink-based browsers right now.
It is on the roadmap for Safari and Firefox for 2024 according to https://developer.mozilla.org/en-US/blog/goodbye-third-party-cookies/

> - What happens if it just stays a draft, or doesn't get accepted, or with a different name?

Good question, no idea.

> 
> And also, would/should the PHP function enforce that this should only be set if for example Secure is set too? And if so, with a warning or TypeError?

This constraint is enforced already in the PR.
If you try to set it without setting Secure, a ValueError is thrown.
This is consistent with how other options can also throw a ValueError if constraints are broken.

> 
> cheers
> Derick 

Kind regards
Niels