Everything

php

[Discussion] Cookies Having Independent Partitioned State (CHIPS)

php.internals

Dmitry Derepko

1 year ago

Hi, Internals!

A few days ago I faced some Cookie limitations, solutions led me to the
CHIPS specification.

Link:
https://developer.mozilla.org/en-US/docs/Web/Privacy/Guides/Privacy_sandbox/Partitioned_cookies

The idea of the CHIPS implementation is to add a new Cookie part named
"Partitioned".

When I set this flag using setcookie function, there was error:
https://3v4l.org/WDpDX

The error raises here:
https://github.com/php/php-src/blob/5853cdb73db85c75d5f558a8cf92161a31291de0/ext/standard/head.c#L205-L220

The workaround is to use the "header" function, which allows any strings
inside.

I want to allow the "Partitioned" key to be set. Shall I open RFC or is it
possible to create only PR with improvements?
Also, I think it may be backported to all the actual PHP versions.

--
Best regards,
Dmitrii Derepko.
@xepozz

Ben Ramsey

1 year ago

> On Jul 5, 2025, at 06:52, Dmitry Derepko <xepozzd@gmail.com> wrote:
>
> Hi, Internals!
>
> A few days ago I faced some Cookie limitations, solutions led me to the CHIPS specification.
>
> Link: https://developer.mozilla.org/en-US/docs/Web/Privacy/Guides/Privacy_sandbox/Partitioned_cookies
>
> The idea of the CHIPS implementation is to add a new Cookie part named "Partitioned".
>
> When I set this flag using setcookie function, there was error: https://3v4l.org/WDpDX
>
> The error raises here:
> https://github.com/php/php-src/blob/5853cdb73db85c75d5f558a8cf92161a31291de0/ext/standard/head.c#L205-L220
>
> The workaround is to use the "header" function, which allows any strings inside.
>
> I want to allow the "Partitioned" key to be set. Shall I open RFC or is it possible to create only PR with improvements?
> Also, I think it may be backported to all the actual PHP versions.
>
> --
> Best regards,
> Dmitrii Derepko.
> @xepozz

The Partitioned parameter isn’t supported in Firefox or Safari. From what I can tell, it’s only supported in Chromium-based browsers. Safari 18.4 supported it, but they removed the support in 18.5. I’d like to understand why, but I haven’t been able to find anything on it.

Cheers,
Ben

Rowan Tommins [IMSoP]

1 year ago

On 5 July 2025 23:26:18 BST, Ben Ramsey <ramsey@php.net> wrote:

>The Partitioned parameter isn’t supported in Firefox or Safari. From what I can tell, it’s only supported in Chromium-based browsers. Safari 18.4 supported it, but they removed the support in 18.5. I’d like to understand why, but I haven’t been able to find anything on it.

Looking at the history of the MDN compatibility table, I found this WebKit PR: <https://github.com/WebKit/WebKit/pull/45504>

> Before 288413@main, Apple platforms blocked all
> third-party cookies by default. In that commit, we
> enabled CHIPS (opt-in partitioned cookies), and that
> required allowing partitioned third-party cookies while
> rejecting unpartitioned cookies. The mechanism for
> rejecting unpartitioned third-party cookies is
> incomplete, so this change disables CHIPS and returns
> to the previous shipping behavior.
>
> We may land a different fix later or fix this in an
> underlying framework.

So it sounds like they approve of the feature in principle, but need more work to implement it correctly.

Meanwhile Firefox seems to have had a similar experience: CHIPS support is listed in the release notes for v131 <https://www.mozilla.org/en-US/firefox/131.0/releasenotes/> but then listed as "re-enabled" in v141 (currently beta) <https://www.mozilla.org/en-US/firefox/141.0beta/releasenotes/>. I haven't found any details of what happened in between.

Reading around various bug trackers, it seems there's been a lot of work on limiting the memory and performance impact of partitioned cookies, so that may also have something to do with the slow rollout.

However, to bring it back to PHP: I haven't seen any debate over the actual attributes used, so updating the validation in setcookie() probably does make sense, with the expectation that it will become widely supported within the next year or two.

Rowan Tommins
[IMSoP]

Tim Düsterhus

1 year ago

Hi

On 7/5/25 13:52, Dmitry Derepko wrote:

> I want to allow the "Partitioned" key to be set. Shall I open RFC or is it
> possible to create only PR with improvements?
> Also, I think it may be backported to all the actual PHP versions.
>

Just a PR should be fine, this follows an external standard and there
should be only one obvious way to implement this. Backporting to
existing PHP versions however is not allowed, since this is not a bugfix
and the documentation of `setcookie()` already says:

> To set a cookie that includes attributes that aren't among the keys listed, use header().

Best regards
Tim Düsterhus

Claude Pache

1 year ago

> Le 6 juil. 2025 à 13:25, Tim Düsterhus <tim@bastelstu.be> a écrit :
>
> Hi
>
> On 7/5/25 13:52, Dmitry Derepko wrote:
>> I want to allow the "Partitioned" key to be set. Shall I open RFC or is it
>> possible to create only PR with improvements?
>> Also, I think it may be backported to all the actual PHP versions.
>
> Just a PR should be fine, this follows an external standard and there should be only one obvious way to implement this. Backporting to existing PHP versions however is not allowed, since this is not a bugfix and the documentation of `setcookie()` already says:
>
>> To set a cookie that includes attributes that aren't among the keys listed, use header().
> Best regards
> Tim Düsterhus

Hi,

In fact, there is already a PR: https://github.com/php/php-src/pull/12652 with a related internals discussion: https://externals.io/message/122028

What has changed since that time, is that the feature will most probably be implemented as specified by all major browsers.

—Claude