Hi, Internals!
A few days ago I faced some Cookie limitations, solutions led me to the
CHIPS specification.
Link:
https://developer.mozilla.org/en-US/docs/Web/Privacy/Guides/Privacy_sandbox/Partitioned_cookies
The idea of the CHIPS implementation is to add a new Cookie part named
"Partitioned".
When I set this flag using setcookie function, there was error:
https://3v4l.org/WDpDX
The error raises here:
https://github.com/php/php-src/blob/5853cdb73db85c75d5f558a8cf92161a31291de0/ext/standard/head.c#L205-L220
The workaround is to use the "header" function, which allows any strings
inside.
I want to allow the "Partitioned" key to be set. Shall I open RFC or is it
possible to create only PR with improvements?
Also, I think it may be backported to all the actual PHP versions.
--
Best regards,
Dmitrii Derepko.
@xepozz
Hi, Internals!
A few days ago I faced some Cookie limitations, solutions led me to the CHIPS specification.
Link: https://developer.mozilla.org/en-US/docs/Web/Privacy/Guides/Privacy_sandbox/Partitioned_cookies
The idea of the CHIPS implementation is to add a new Cookie part named "Partitioned".
When I set this flag using setcookie function, there was error: https://3v4l.org/WDpDX
The error raises here:
https://github.com/php/php-src/blob/5853cdb73db85c75d5f558a8cf92161a31291de0/ext/standard/head.c#L205-L220The workaround is to use the "header" function, which allows any strings inside.
I want to allow the "Partitioned" key to be set. Shall I open RFC or is it possible to create only PR with improvements?
Also, I think it may be backported to all the actual PHP versions.--
Best regards,
Dmitrii Derepko.
@xepozz
The Partitioned parameter isn’t supported in Firefox or Safari. From what I can tell, it’s only supported in Chromium-based browsers. Safari 18.4 supported it, but they removed the support in 18.5. I’d like to understand why, but I haven’t been able to find anything on it.
Cheers,
Ben
The Partitioned parameter isn’t supported in Firefox or Safari. From what I can tell, it’s only supported in Chromium-based browsers. Safari 18.4 supported it, but they removed the support in 18.5. I’d like to understand why, but I haven’t been able to find anything on it.
Looking at the history of the MDN compatibility table, I found this WebKit PR: https://github.com/WebKit/WebKit/pull/45504
Before 288413@main, Apple platforms blocked all
third-party cookies by default. In that commit, we
enabled CHIPS (opt-in partitioned cookies), and that
required allowing partitioned third-party cookies while
rejecting unpartitioned cookies. The mechanism for
rejecting unpartitioned third-party cookies is
incomplete, so this change disables CHIPS and returns
to the previous shipping behavior.We may land a different fix later or fix this in an
underlying framework.
So it sounds like they approve of the feature in principle, but need more work to implement it correctly.
Meanwhile Firefox seems to have had a similar experience: CHIPS support is listed in the release notes for v131 https://www.mozilla.org/en-US/firefox/131.0/releasenotes/ but then listed as "re-enabled" in v141 (currently beta) https://www.mozilla.org/en-US/firefox/141.0beta/releasenotes/. I haven't found any details of what happened in between.
Reading around various bug trackers, it seems there's been a lot of work on limiting the memory and performance impact of partitioned cookies, so that may also have something to do with the slow rollout.
However, to bring it back to PHP: I haven't seen any debate over the actual attributes used, so updating the validation in setcookie() probably does make sense, with the expectation that it will become widely supported within the next year or two.
Rowan Tommins
[IMSoP]
Hi
I want to allow the "Partitioned" key to be set. Shall I open RFC or is it
possible to create only PR with improvements?
Also, I think it may be backported to all the actual PHP versions.
Just a PR should be fine, this follows an external standard and there
should be only one obvious way to implement this. Backporting to
existing PHP versions however is not allowed, since this is not a bugfix
and the documentation of setcookie() already says:
To set a cookie that includes attributes that aren't among the keys listed, use
header().
Best regards
Tim Düsterhus
Le 6 juil. 2025 à 13:25, Tim Düsterhus tim@bastelstu.be a écrit :
Hi
I want to allow the "Partitioned" key to be set. Shall I open RFC or is it
possible to create only PR with improvements?
Also, I think it may be backported to all the actual PHP versions.Just a PR should be fine, this follows an external standard and there should be only one obvious way to implement this. Backporting to existing PHP versions however is not allowed, since this is not a bugfix and the documentation of
setcookie()already says:To set a cookie that includes attributes that aren't among the keys listed, use
header().
Best regards
Tim Düsterhus
Hi,
In fact, there is already a PR: https://github.com/php/php-src/pull/12652 with a related internals discussion: https://externals.io/message/122028
What has changed since that time, is that the feature will most probably be implemented as specified by all major browsers.
—Claude