Support for Partitioned cookie attribute (AKA CHIPS)

[jdf200]

I have recently been checking our Play app's compliance with the upcoming change Google is planning to block 3rd party cookies / partition those cookies to the top level domain.

We have an application that is embedded within a site as an iframe on a different top level domain which needs to set cookies, however under Googles proposed model (CHIPS) we will need to add a 'Partitioned' attribute to the Set-Cookie header.

I've checked the Play documentation and implementation and I cannot see any simple way of adding this in the current model.

I have implemented a workaround by injecting a overridden version of the CookieHeaderEncoding class into my application, however this is not ideal.

Are there any plans to add this flag to the Cookie class / configuration in an upcoming release? Or is there a cleaner way to add additional flags to the Set-Cookie response?

[mkurz]

If this is just about adding ...; Partitioned; to a cookie, this isn't really hard to support in Play. However looking at https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie this still is experimental. Let's wait until Firefox implements the flag before we add it to Play? https://bugzilla.mozilla.org/show_bug.cgi?id=1859715

[mkurz]

Maybe we should make it a bit more flexible which attributes we allow to set to the session/flash/... and custom cookies by allowing to pass a list of strings and also support that in the config, so we don't have to make breaking changes to the cookie api in future and devs can just add they own attributes if they desire.
Also that would make the cookie api more future proof because we do not have release new Play versions just to support new cookie attributes...