[PHP-DEV] [Discussion] Cookies Having Independent Partitioned State (CHIPS)

Mailing Lists php.internals
1

Hi, Internals!

A few days ago I faced some Cookie limitations, solutions led me to the CHIPS specification.

Link: https://developer.mozilla.org/en-US/docs/Web/Privacy/Guides/Privacy_sandbox/Partitioned_cookies

The idea of the CHIPS implementation is to add a new Cookie part named “Partitioned”.

When I set this flag using setcookie function, there was error: https://3v4l.org/WDpDX

The error raises here:
https://github.com/php/php-src/blob/5853cdb73db85c75d5f558a8cf92161a31291de0/ext/standard/head.c#L205-L220

The workaround is to use the “header” function, which allows any strings inside.

I want to allow the “Partitioned” key to be set. Shall I open RFC or is it possible to create only PR with improvements?
Also, I think it may be backported to all the actual PHP versions.

···

Best regards,

Dmitrii Derepko.
@xepozz

2

On Jul 5, 2025, at 06:52, Dmitry Derepko <xepozzd@gmail.com> wrote:

Hi, Internals!

A few days ago I faced some Cookie limitations, solutions led me to the CHIPS specification.

Link: Cookies Having Independent Partitioned State (CHIPS) - Privacy on the web | MDN

The idea of the CHIPS implementation is to add a new Cookie part named "Partitioned".

When I set this flag using setcookie function, there was error: Online PHP editor | output for WDpDX

The error raises here:
php-src/ext/standard/head.c at 5853cdb73db85c75d5f558a8cf92161a31291de0 · php/php-src · GitHub

The workaround is to use the "header" function, which allows any strings inside.

I want to allow the "Partitioned" key to be set. Shall I open RFC or is it possible to create only PR with improvements?
Also, I think it may be backported to all the actual PHP versions.

--
Best regards,
Dmitrii Derepko.
@xepozz

The Partitioned parameter isn’t supported in Firefox or Safari. From what I can tell, it’s only supported in Chromium-based browsers. Safari 18.4 supported it, but they removed the support in 18.5. I’d like to understand why, but I haven’t been able to find anything on it.

Cheers,
Ben

3

On 5 July 2025 23:26:18 BST, Ben Ramsey <ramsey@php.net> wrote:

The Partitioned parameter isn’t supported in Firefox or Safari. From what I can tell, it’s only supported in Chromium-based browsers. Safari 18.4 supported it, but they removed the support in 18.5. I’d like to understand why, but I haven’t been able to find anything on it.

Looking at the history of the MDN compatibility table, I found this WebKit PR: <https://github.com/WebKit/WebKit/pull/45504&gt;

Before 288413@main, Apple platforms blocked all
third-party cookies by default. In that commit, we
enabled CHIPS (opt-in partitioned cookies), and that
required allowing partitioned third-party cookies while
rejecting unpartitioned cookies. The mechanism for
rejecting unpartitioned third-party cookies is
incomplete, so this change disables CHIPS and returns
to the previous shipping behavior.

We may land a different fix later or fix this in an
underlying framework.

So it sounds like they approve of the feature in principle, but need more work to implement it correctly.

Meanwhile Firefox seems to have had a similar experience: CHIPS support is listed in the release notes for v131 <https://www.mozilla.org/en-US/firefox/131.0/releasenotes/&gt; but then listed as "re-enabled" in v141 (currently beta) <https://www.mozilla.org/en-US/firefox/141.0beta/releasenotes/&gt;\. I haven't found any details of what happened in between.

Reading around various bug trackers, it seems there's been a lot of work on limiting the memory and performance impact of partitioned cookies, so that may also have something to do with the slow rollout.

However, to bring it back to PHP: I haven't seen any debate over the actual attributes used, so updating the validation in setcookie() probably does make sense, with the expectation that it will become widely supported within the next year or two.

Rowan Tommins
[IMSoP]

4

Hi

On 7/5/25 13:52, Dmitry Derepko wrote:

I want to allow the "Partitioned" key to be set. Shall I open RFC or is it
possible to create only PR with improvements?
Also, I think it may be backported to all the actual PHP versions.

Just a PR should be fine, this follows an external standard and there should be only one obvious way to implement this. Backporting to existing PHP versions however is not allowed, since this is not a bugfix and the documentation of `setcookie()` already says:

To set a cookie that includes attributes that aren't among the keys listed, use header().

Best regards
Tim Düsterhus

5

Le 6 juil. 2025 à 13:25, Tim Düsterhus tim@bastelstu.be a écrit :

Hi

On 7/5/25 13:52, Dmitry Derepko wrote:

I want to allow the “Partitioned” key to be set. Shall I open RFC or is it
possible to create only PR with improvements?
Also, I think it may be backported to all the actual PHP versions.

Just a PR should be fine, this follows an external standard and there should be only one obvious way to implement this. Backporting to existing PHP versions however is not allowed, since this is not a bugfix and the documentation of setcookie() already says:

To set a cookie that includes attributes that aren’t among the keys listed, use header().

Best regards
Tim Düsterhus

Hi,

In fact, there is already a PR: https://github.com/php/php-src/pull/12652 with a related internals discussion: https://externals.io/message/122028

What has changed since that time, is that the feature will most probably be implemented as specified by all major browsers.

—Claude