Updates the parsing of cookie strings to allow a cookie's domain attribute to be set to the empty string. This change will also correct the failing web-platform tests related to an empty string domain. Additionally, it brings Chrome in alignment with the draft RFC6265bis specification, and will improve interoperability with Safari and Firefox by matching their treatment of an empty cookie domain attribute.

Motivation

Currently, Chrome exhibits confusing and non-standard behavior when a cookie is set with an empty string in the domain attribute. In Chrome's ParsedCookie class and related unit and web-platform tests, a cookie string with an empty string domain does not set the domain attribute. Functionally, this causes a cookie’s domain value to equal the previously specified domain for this cookie if present. However, this behavior conflicts with the RFC6265bis, as the resulting cookie in this situation should simply be bound to its request url’s host, termed a “host cookie.” The goal of this design is to align Chrome’s behavior with the domain attribute handling described in the draft RFC6265bis, and by extension, correct errors in cookie tests resulting from this behavior change.

Documentation

Specification

Specification link


Specification currently under development in a Working Group

Status in Chromium

Internals>Network>Cookies


Proposed (tracking bug)

Consensus & Standardization

After a feature ships in Chrome, the values listed here are not guaranteed to be up to date.

  • Shipped/Shipping
  • Shipped/Shipping
  • Positive

Owners

Comments

Design Document: https://docs.google.com/document/d/1oyG_OF9YrMR1icbvh9rAT6dFcb7qiKOf2wCngKIWNto/edit?usp=sharing

Last updated on 2021-11-29