From 90e9a81783cd8d3b3fcb74df2c3e6b018be28a9a Mon Sep 17 00:00:00 2001 From: Dmitry Verkhoturov Date: Mon, 24 Aug 2026 01:52:38 +0100 Subject: [PATCH] Drop the last clause narrating an earlier draft The paragraph correcting the coexistence claim opened by saying an earlier reading had it wrong, which is the same history narration the commit before it removed from four other places. The fact stands without it. --- docs/plans/2026-08-19-frontend-simplification.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/docs/plans/2026-08-19-frontend-simplification.md b/docs/plans/2026-08-19-frontend-simplification.md index 124b7f0f..a3d6ecd8 100644 --- a/docs/plans/2026-08-19-frontend-simplification.md +++ b/docs/plans/2026-08-19-frontend-simplification.md @@ -136,12 +136,12 @@ a missing attribute as `Lax`, so the cookie is not sent cross-site; on WebKit an third-party blocking, which applies whatever the attribute says. Only the outcome was measured; the causes are read off documented browser behaviour. -The two pairs are not in competition, which an earlier reading of this had wrong. CHIPS makes the -partition key part of a cookie's identity, so a partitioned cookie and an unpartitioned one of the -same name are different cookies and coexist: #2218 measured all four at once on Chromium with both -settings on. Firefox is the exception precisely because Total Cookie Protection files the server's -cookie under the embedder's partition, which makes the keys match, and a script may not replace an -`HttpOnly` cookie whose key it collides with. +The two pairs are not in competition. CHIPS makes the partition key part of a cookie's identity, so +a partitioned cookie and an unpartitioned one of the same name are different cookies and coexist: +#2218 measured all four at once on Chromium with both settings on. Firefox is the exception +precisely because Total Cookie Protection files the server's cookie under the embedder's partition, +which makes the keys match, and a script may not replace an `HttpOnly` cookie whose key it collides +with. On Firefox the server's pair is accepted, and since the `JWT` it sets is `HttpOnly`, the browser then forbids the widget's script from replacing a cookie of that name. So Firefox never holds a