Re: portals and same site cookies?

• From: Domenic Denicola <d@domenic.me>
• Date: Thu, 6 Aug 2020 15:16:24 +0000
• To: "public-webappsec@w3.org" <public-webappsec@w3.org>
• Message-ID: <MN2PR13MB3613B888D800FD9880308609DF480@MN2PR13MB3613.namprd13.prod.outlook.com>

> It seems its still not clear what the decision is though.

The decision is captured in https://github.com/WICG/portals#storage-access-blocking. Portals have no access to their storage (including cookies) until activation, and upon activation they have full first-party access.

> Chrome already shipped with sending lax same-site cookies.

I'm not sure what you mean by this. Chrome is not shipping portals at this time. There is an origin trial out for same-origin only portals on Android devices, but I can't square that with your sentence.

Received on Thursday, 6 August 2020 15:16:51 UTC