search

privacycg / CHIPS

A proposal for a cookie attribute to partition cross-site cookies by top-level site
Other
116 stars 29 forks source link

Clarify behavior when over partition capacity #85

Open bvandersloot-mozilla opened 4 months ago

bvandersloot-mozilla commented 4 months ago

Redirecting from here as it isn't specific to the 1vs10 KB limit.

I think there is an interesting open question that may be worth aligning on as we have a smaller byte cap. From @edgul, implementing this in Gecko:

If we assume a per-partition byte limit of 10KB, then it's not hard to imagine the scenario where 10 cookies of 1KB (or perhaps 100 cookies of 100B) are set which stay valid for the foreseeable future and then the next cookie comes along. [...] What is the intended/implemented behaviour? Outright rejection of the newest cookie? Removal of the oldest (still valid) cookie?

cc @DCtheTall

johannhof commented 3 months ago

I think this is defined in https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis/#section-5.6-6 (end of "Storage Model" in case the link doesn't work), right? We might want to update the CHIPS spec a bit to amend that section to talk about same domain and same partition-key.

bvandersloot-mozilla commented 3 months ago

I agree we should use that method. I just wasn't sure if that was your intent in the explainer!