-
Notifications
You must be signed in to change notification settings - Fork 18
Description
Exposing whether an environment is partitioned, mainly through an HTTP request header, came up in the last cookie discussion privacycg/meetings#19 (again). There's a couple different ideas floating around addressing various use cases around security and developer ergonomics.
Sec-Fetch-Ancestors? w3c/webappsec-fetch-metadata#56- Fetch-Metadata to indicate when the browser is in a partitioned context w3c/webappsec-fetch-metadata#80
- User agents should indicate to servers whether a request is cross-site CHIPS#2
- Expose the first party to a partitioned third party #14 (although at this point nobody seems to seriously suggest exposing the full site anymore so maybe that can be closed?)
#31 and #25 also relate to this in that for cookies people have suggested a different keying setup, which really drives home the point that we have to be very careful with what we end up doing in this space.
I think having an equivalent to Sec-Fetch-Site that tells you something about your ancestor documents (none, same-origin, same-site, or cross-site) still makes a lot of sense. However, in a A1 -> B -> A2 scenario this header would signal cross-site for A2, which might not make it clear enough it can still set SameSite=None cookies (depending on how #31 gets decided). It would indicate that CHIPS cookies would work however so maybe that is good enough. (The main alternative I can think of is that we'd expose a separate "what is my site relation with the top-level" header, but I'm not convinced that carries its weight.)