go-pkgz / auth / 32584147060

86%

master: 87%

Pull #315

github

Add PartitionedCookies for third-party (CHIPS) deployments

An application framed by another site gets its auth cookies as
third-party cookies, and browsers now drop those unless they carry
Partitioned. Neither Set nor Reset could emit the attribute, so an
embedded deployment had no way to keep a session across a reload.

PartitionedCookies is opt-in and defaults off, so existing deployments
write byte-identical cookies. It is deliberately not implied by
SameSite=None: the partition key is the embedding top-level site, so
implying it would silently move an existing cookie into a different jar.

Both Set and Reset carry it, which matters more than it looks. A
partitioned cookie and an unpartitioned expiry are different cookies to
the browser, so clearing without the attribute leaves the original in
place and the user stays signed in. Verified in Chromium against a
genuine cross-site embed over https: the unpartitioned expiry leaves the
value readable, the partitioned one removes it.

Mirrored in v1 and v2 per the project rule for shared behaviour.

19 of 24 new or added lines in 2 files covered. (79.17%)

3215 of 3734 relevant lines covered (86.1%)

9.65 hits per line