dotnet / dotnet/aspnetcore

Add support for Partitioned Cookies

Open
#53,224 11 comments 7 reactions 0 assignees View on GitHub
area-auth
Dominant language
C#
Stars
38.4k
Forks
10.9k
Avg merge
2d 6h
Merged PRs (30d)
290

Description

### Is there an existing issue for this?

- [X] I have searched the existing issues

### Is your feature request related to a problem? Please describe the problem.

CookieBuilder should support the new Partitioned property from the [CHIPS (Cookies Having Independent Partitioned State) spec.](https://github.com/privacycg/CHIPS) to avoid users having to fall back to the extensions property.

Both Chrome and Safari have indicated their support.

[RFC status](https://datatracker.ietf.org/doc/draft-ietf-httpbis-rfc6265bis/)

### Describe the solution you'd like

A true or false property on CookieBuilder much like SameSite has today.

If the Paritioned property is set to true the cookie should be emitted with `Partitioned;`

`Set-Cookie: Beans=baked; SameSite=None; Secure; HttpOnly; Path=/; Partitioned;`

The Partioned attribute can only be used with a Secure attribute, and the spec says browsers MUST reject a partitioned cookie if Secure is not present, so the builder could throw an exception on build.

A cookie that does not have SameSite=None but is partitioned really isn't partitioned at all, it's not going to be seen by third parties, but in that case the spec says Browsers MAY, so a debug message may be useful in that circumstance to help users track down that mistake.

### Additional context

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.