diff --git a/docs/plans/2026-08-19-frontend-simplification.md b/docs/plans/2026-08-19-frontend-simplification.md index 124b7f0f..a3d6ecd8 100644 --- a/docs/plans/2026-08-19-frontend-simplification.md +++ b/docs/plans/2026-08-19-frontend-simplification.md @@ -136,12 +136,12 @@ a missing attribute as `Lax`, so the cookie is not sent cross-site; on WebKit an third-party blocking, which applies whatever the attribute says. Only the outcome was measured; the causes are read off documented browser behaviour. -The two pairs are not in competition, which an earlier reading of this had wrong. CHIPS makes the -partition key part of a cookie's identity, so a partitioned cookie and an unpartitioned one of the -same name are different cookies and coexist: #2218 measured all four at once on Chromium with both -settings on. Firefox is the exception precisely because Total Cookie Protection files the server's -cookie under the embedder's partition, which makes the keys match, and a script may not replace an -`HttpOnly` cookie whose key it collides with. +The two pairs are not in competition. CHIPS makes the partition key part of a cookie's identity, so +a partitioned cookie and an unpartitioned one of the same name are different cookies and coexist: +#2218 measured all four at once on Chromium with both settings on. Firefox is the exception +precisely because Total Cookie Protection files the server's cookie under the embedder's partition, +which makes the keys match, and a script may not replace an `HttpOnly` cookie whose key it collides +with. On Firefox the server's pair is accepted, and since the `JWT` it sets is `HttpOnly`, the browser then forbids the widget's script from replacing a cookie of that name. So Firefox never holds a