Drop the last clause narrating an earlier draft
The paragraph correcting the coexistence claim opened by saying an earlier reading had it wrong, which is the same history narration the commit before it removed from four other places. The fact stands without it.
This commit is contained in:
@@ -136,12 +136,12 @@ a missing attribute as `Lax`, so the cookie is not sent cross-site; on WebKit an
|
||||
third-party blocking, which applies whatever the attribute says. Only the outcome was measured; the
|
||||
causes are read off documented browser behaviour.
|
||||
|
||||
The two pairs are not in competition, which an earlier reading of this had wrong. CHIPS makes the
|
||||
partition key part of a cookie's identity, so a partitioned cookie and an unpartitioned one of the
|
||||
same name are different cookies and coexist: #2218 measured all four at once on Chromium with both
|
||||
settings on. Firefox is the exception precisely because Total Cookie Protection files the server's
|
||||
cookie under the embedder's partition, which makes the keys match, and a script may not replace an
|
||||
`HttpOnly` cookie whose key it collides with.
|
||||
The two pairs are not in competition. CHIPS makes the partition key part of a cookie's identity, so
|
||||
a partitioned cookie and an unpartitioned one of the same name are different cookies and coexist:
|
||||
#2218 measured all four at once on Chromium with both settings on. Firefox is the exception
|
||||
precisely because Total Cookie Protection files the server's cookie under the embedder's partition,
|
||||
which makes the keys match, and a script may not replace an `HttpOnly` cookie whose key it collides
|
||||
with.
|
||||
|
||||
On Firefox the server's pair is accepted, and since the `JWT` it sets is `HttpOnly`, the browser
|
||||
then forbids the widget's script from replacing a cookie of that name. So Firefox never holds a
|
||||
|
||||
Reference in New Issue
Block a user