Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:128140
Message-ID: <520a4e54-eb18-41f7-871f-d5929fce3eb0@gmail.com>
Date: Sun, 20 Jul 2025 11:14:05 +0200
Precedence: bulk
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: [PHP-DEV] [RFC] [Discussion] CHIPS
To: internals@lists.php.net
References: <CANTuiHsW99Ny-Cx1+kyU0+Q4bimnGWZe+stWd0wvSSfO=zwvgw@mail.gmail.com>
 <6F5072EB-E477-4CCD-8FF0-E09C2C10ED47@gmail.com>
Content-Language: en-US
In-Reply-To: <6F5072EB-E477-4CCD-8FF0-E09C2C10ED47@gmail.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
From: dossche.niels@gmail.com (Niels Dossche)

On 18/07/2025 16:15, Claude Pache wrote:
> Hi,
> 

Hi Claude

> 1. The RFC says: “CHIPS technology was introduced not so long ago, but still has “little” adoption (currently “only” available in Blink-based browsers).”
> 
> It might be useful to add the following precisions, so that we are more confident that it has good chance not to remain a Blink-only feature:
> * As of time of writing, there is an experimental implementation in Firefox.
> * The feature has also been implemented in Safari, but has been temporarily disabled because of an issue known by Apple only.
> 

Sure! Those are good points to clarify the introduction. Thanks!

> 
> 2. All examples in the RFC are variations on `setcookie("name", "value", ["secure" => true, "partitioned" => true]);`, without same-site attribute.
> 
> As partitioned cookies are only meaningful as third-party cookies, what is the behaviour when:
> 
> (a) the same-site attribute is set to anything different from "None"?
> (b) the same-site attribute is omitted? (Although historically, omitting the same-site parameter is equivalent to setting it to "None", browser vendors are willing to switch the default to "Lax", and some browsers (including Blink-based ones) have already done the switch.)
> 
> In all examples I’ve seen on the web, an explicit `samesite=None` attribute is added to partitioned cookies, probably for some good reason?

Yep, all examples use "samesite=None" because you need that to create a 3rd party cookie. So including "Partitioned" without "samesite=None" is useless in those cases.
Although if "samesite=Lax" is still the default for a particular browser, then it won't be useless, but I believe the goal is - as you said - to switch all browsers over to "samesite=None".
According to https://github.com/privacycg/CHIPS, the following will happen:

(a) The cookie won't be sent to a 3rd party context and "Partitioned" won't have an effect. The cookie header is still interpreted correctly so it will have an effect on the origin site, just not in a 3rd party context.
(b) Depends on what the default is for a particular browser.

Kind regards
Niels