Standardizing Security Semantics of Cross-Site Cookies

[DCtheTall]

WebKittens

@annevk @johnwilander

Title of the spec

Standardizing Security Semantics of Cross-Site Cookies

URL to the spec

https://github.com/DCtheTall/standardizing-cross-site-cookie-semantics

URL to the spec's repository

No response

Issue Tracker URL

No response

Explainer URL

No response

TAG Design Review URL

No response

Mozilla standards-positions issue URL

mozilla/standards-positions#806

WebKit Bugzilla URL

No response

Radar URL

No response

Description

This document proposes to standardize the security semantics of cross-site cookies when third-party cookie blocking is enabled. The main points we would like to make standard behavior are:

• Block third-party cookies from being written or read by same-site embeds with cross-site ancestors (aka ABA embeds) unless the embed is granted storage access.
• Block cookies in first-party subresource requests that were redirects from third-party URLs.
• Allows cookies to be sent in top-level POST navigation requests to continue supporting prevalent use cases like 3D-Secure.

Since this behavior causes third-party cookie blocking to be stricter in WebKit than the current state (particularly for ABA embeds) we can work with you to minimize the compat impact.

[johnwilander]

Hi! Thanks for filing. Could you move your spec to a group where it’s under W3C’s governance and has clear rules on intellectual property, please? We try to avoid commenting on things in personal repos. Thanks!

[johannhof]

Thanks for pointing that out John, and apologies, we'll look into that.