expressjs/session

[Feature Request] Support of phasing out third-party cookies

nicob-29 opened this issue · 16 comments

nicob-29 commented

Hi
Google plan soon to activate phasing out third-party cookies
See Third-Party Cookies doc: https://privacysandbox.com/open-web/#the-privacy-sandbox-timeline

Doc about phasing out third-party cookies: https://developer.chrome.com/en/docs/privacy-sandbox/third-party-cookie-phase-out/#partitioned-cookies

This feature request requires the possibility to add "Partitioned" to the cookie like Secure.

sergioRozenszajn commented

Hi,
We have the same urgent requirement, do you have any plans/timelines to support Partitioned cookie property?
We tried to workaround but it looks like not there is none.

dougwilson commented

The implementation is being discussed currently but should be integrated soon.

  • 👍3
sblecon commented

Hi @dougwilson ,
Any idea when the fix will be available?
Best regards,
Stéphane

stefanbeigel commented

Hi,
we also need such support to test partitioned cookies for our sessions.

nicob-29 commented

Hi
Any update ?

stefanbeigel commented

@nicob-29
I think it needs to be added to cookie library first, which was done but not released yet
jshttp/cookie#153
Because it's used here:
https://github.com/expressjs/session/blob/master/session/cookie.js#L14

nicob-29 commented

@sergioRozenszajn
jshttp/cookie about partitioned was released (See version 0.6.0)
https://github.com/jshttp/cookie/releases is not good but

image

  • 👍1
dougwilson commented

Thank you, I missed added it to the github releases. There is a long holiday where I am currently, sorry for the delayed reply. I will get out a new release of this with partitioned support asap for you all.

  • ❤️1
nicob-29 commented

@sergioRozenszajn
The version of cookie was released yesterday ;-)
Thank you @dougwilson

sergioRozenszajn commented

Hi @dougwilson , @nicob-29

In the meantime I forked into https://github.com/sergioRozenszajn/approuter-session.git, using cookie 0.6.0 and adding partitioned to data:
, sameSite: this.sameSite
, partitioned: this.partitioned
Using this fork the JSESSIONID cookie is now partitioned:
image

  • 👍1
nicob-29 commented

@dougwilson
Any news ?

dougwilson commented

Hi @nicob-29 I just got home yesterday and working through the backlog. Please if you can give me a little breather from the holiday to get it done, that would be great.

nicob-29 commented

Sure !

cattermo commented

Please start work on this 🙏
Since Chrome will start blocking from beginning of next year it's starting to become very urgent.

  • 👍7
nicob-29 commented

Happy New Year
Friendly reminder.

rgsthethird commented

Another request for this to be added soon. Thanks!