Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:127913
Feedback-ID: id5114917:Fastmail
Date: Sun, 06 Jul 2025 12:01:39 +0100
To: internals@lists.php.net
Subject: =?US-ASCII?Q?Re=3A_=5BPHP-DEV=5D_=5BDiscussion=5D_Cookies_Havi?=
 =?US-ASCII?Q?ng_Independent_Partitioned_State_=28CHIPS=29?=
User-Agent: K-9 Mail for Android
In-Reply-To: <0D711888-1BDC-42E1-8EFE-B77681AE8BF4@php.net>
References: <CANTuiHvbBHfGFzzZyqkgejPR0GGUnVxVsoqWsRg9GiT2_VWteg@mail.gmail.com> <0D711888-1BDC-42E1-8EFE-B77681AE8BF4@php.net>
Message-ID: <749ABEBF-3F33-45A3-A518-AFA455FA80CC@rwec.co.uk>
Precedence: bulk
MIME-Version: 1.0
Content-Type: text/plain;
 charset=utf-8
Content-Transfer-Encoding: quoted-printable
From: imsop.php@rwec.co.uk ("Rowan Tommins [IMSoP]")

On 5 July 2025 23:26:18 BST, Ben Ramsey <ramsey@php=2Enet> wrote:
>The Partitioned parameter isn=E2=80=99t supported in Firefox or Safari=2E=
 From what I can tell, it=E2=80=99s only supported in Chromium-based browse=
rs=2E Safari 18=2E4 supported it, but they removed the support in 18=2E5=2E=
 I=E2=80=99d like to understand why, but I haven=E2=80=99t been able to fin=
d anything on it=2E


Looking at the history of the MDN compatibility table, I found this WebKit=
 PR: <https://github=2Ecom/WebKit/WebKit/pull/45504>

> Before 288413@main, Apple platforms blocked all
> third-party cookies by default=2E In that commit, we
> enabled CHIPS (opt-in partitioned cookies), and that
> required allowing partitioned third-party cookies while
> rejecting unpartitioned cookies=2E The mechanism for
> rejecting unpartitioned third-party cookies is
> incomplete, so this change disables CHIPS and returns
> to the previous shipping behavior=2E
>
> We may land a different fix later or fix this in an
> underlying framework=2E


So it sounds like they approve of the feature in principle, but need more =
work to implement it correctly=2E


Meanwhile Firefox seems to have had a similar experience: CHIPS support is=
 listed in the release notes for v131 <https://www=2Emozilla=2Eorg/en-US/fi=
refox/131=2E0/releasenotes/> but then listed as "re-enabled" in v141 (curre=
ntly beta) <https://www=2Emozilla=2Eorg/en-US/firefox/141=2E0beta/releaseno=
tes/>=2E I haven't found any details of what happened in between=2E=20


Reading around various bug trackers, it seems there's been a lot of work o=
n limiting the memory and performance impact of partitioned cookies, so tha=
t may also have something to do with the slow rollout=2E

However, to bring it back to PHP: I haven't seen any debate over the actua=
l attributes used, so updating the validation in setcookie() probably does =
make sense, with the expectation that it will become widely supported withi=
n the next year or two=2E=20



Rowan Tommins
[IMSoP]