search

mdn / sprints

Archived: MDN Web Docs issues are tracked in the content repository.
https://github.com/mdn/content
Creative Commons Zero v1.0 Universal
149 stars 142 forks source link

Document.cookie examples don't work #3942

Closed lox-enterprises closed 3 years ago

lox-enterprises commented 3 years ago

Request type

Details

The examples on this page no longer work: https://developer.mozilla.org/en-US/docs/Web/API/Document/cookie

It seems you cannot access document.cookie anymore from JavaScript, it always returns an empty string. I'm on Google Chrome/Linux.

Perhaps the examples should be removed and/or notice added.

vkWeb commented 3 years ago

@1202software @chrisdavidmills umm, I can try looking into what's going on.

vkWeb commented 3 years ago

After looking a bit on this I got to know that Google Chrome doesn't allow cookie reads / writes from file:// protocol. Other browsers allow that. Chrome allows cookie reads/writes from http protocol only: https://bugs.chromium.org/p/chromium/issues/detail?id=535.

hamishwillee commented 3 years ago

No, this is an issue due to expected security behaviour, as reported in https://support.google.com/chrome/thread/33543699?hl=en (i.e. related to SameSite and iframes). You can see these working if you load the source pages directly in chrome. https://mdn.mozillademos.org/en-US/docs/Web/API/Document/cookie$samples/Example_2_Get_a_sample_cookie_named_test2?revision=1591237

There are a couple of potential problems outlined there. The example is in an embedded iframe with a different domain.

<iframe class="live-sample-frame sample-code-frame" frameborder="0" height="36" id="frame_Example_1_Simple_usage" src="https://mdn.mozillademos.org/en-US/docs/Web/API/Document/cookie$samples/Example_1_Simple_usage?revision=1652690" width="200"></iframe>

From a SameSite cookie perspective on chrome this means that cookies will not be sent by default (it will be set to Lax).

To fix this, first I'd try modifying the examples to add the SameSite as shown - e.g. 

document.cookie = "name=oeschger; SameSite=None; Secure;";

That will probably work, but it is possible that the iframe itself will put further restrictions on calling this API (doesn't appear to on quick scan of docs).

@chrisdavidmills Where are the examples on https://mdn.mozillademos.org actually stored/specified? making the change above to add SameSite=None; Secure; would do "no harm" IMO, though there will need to be a note added in docs.

PS. If that doesn't work then we'll have to look closer at the iframe itself. It may be that this has to be a link to example rather than embed. I'd kind of prefer that - only suggesting the samesite change because it gives us an opportunity to make some comments about how important SameSite is now.

chrisdavidmills commented 3 years ago

@hamishwillee that's a good question — I'm not really sure how to access those demos.

@escattone , do you how the answer to this?

I'd be in favor of moving those demos across to a repo somewhere under https://github.com/mdn/ at some point.

escattone commented 3 years ago

@chrisdavidmills I think @hamishwillee is right on here (thank you), but I probably won't be able to look into this in more detail until next week due to everything else going on for the launch of Yari a week from today.

hamishwillee commented 3 years ago

@escattone Just a reminder, that this one is still a problem.

chrisdavidmills commented 3 years ago

Issue moved to mdn/yari #2579 via ZenHub