Add support for the Partitioned cookie attribute

[amcasey]

...to support CHIPS (Cookies Having Independent Partitioned State).

Fixes #53224
Fixes #55370

[halter73]

@blowdart I just left a comment on the issue you filed for this, but I'll repeat it here. Are we really doing this for an expired draft spec that's only supported by chromium-based browsers when the workaround is nearly as easy to use as the proposed API?

New API:

options.Cookie.Partitioned = true;

Workaround:

options.Cookie.Extensions.Add("partitioned");

We did approve the API, but we were a little rushed. And I don't think the workaround was ever demonstrated. The simplicity of the workaround really makes me want to hold off on this until the spec is final.

[blowdart]

I take your point about the spec, but it's one of those that is unlikely to change (in my opinion) now that cookie has full throttle committed to it.

[amcasey]

I take your point about the spec, but it's one of those that is unlikely to change (in my opinion) now that cookie has full throttle committed to it.

I'm guessing that was meant to be "chrome has full throttle committed to it".

[blowdart]

Mozilla views it positively
Webkit views it positively

(Basically we'll add it soon)

Google started the staged rollout in chrome for 1% of users. although they stopped because regulators objected.

[amcasey]

@blowdart @halter73 Would it be preferable to merge early and get feedback but be ready to pull it or save this until the last minute to build confidence that browsers will actually adopt it?

[gfoidl]

I don't know if it matters here, as the enum isn't embedded in a type.

Suggested change

	private enum MessagesToLog
	private enum MessagesToLog : byte

to make the enum smaller (1 byte vs. 4 bytes for int (default)).

[amcasey]

Thanks! I considered that, but decided against it for two reasons. First, I'm expecting there to be more flags in the future. I've already added one since the PR began. 😆 Second, I figured space saving was probably less valuable than simplified alignment on the stack (though I didn't measure).

[dotnet-policy-service]

Looks like this PR hasn't been active for some time and the codebase could have been changed in the meantime.
To make sure no conflicting changes have occurred, please rerun validation before merging. You can do this by leaving an /azp run comment here (requires commit rights), or by simply closing and reopening.

[amcasey]

@halter73 @blowdart Where are we on this? Is the spec far enough along that we're comfortable merging (once CI is green)? We're running out of time to add new APIs.

[amcasey]

Force push is a trivial rebase on main.

[blowdart]

Go added it already. My vote is to do it now.

[halter73]

Am I correct in understanding that it's almost been three months since this PR was opened and six months since the issue was filed and there hasn't been any movement on making this expired draft spec more real in that time? AFAICT, Chrome still hasn't blocked third-party cookies by default due to regulator objections.

I didn't realize the regulators were involved in this situation when I first reviewed this PR, but knowing about this makes me even more hesitant to merge this. I can see why regulators might have something to say about Chrome blocking third-party cookies given Google could track you anyway unlike their advertising competitors. And I could see regulators' decisions about what cookies Google can block affecting the final design of CHIPS or a competing standard.

It also appears that Firefox and Safari both still don't support CHIPS even though Firefox already partitions third-party cookies and Safari already blocks them.

I would be for merging this if the spec was ratified. Or if Firefox or Safari implemented. Or maybe if Chrome actually did start blocking cookies by default. But it appears none of this has happened yet. Remember we're comparing

options.Cookie.Partitioned = true;

to

options.Cookie.Extensions.Add("partitioned");

The only benefit to the new API is discoverability, but we don't even know if this is going to exist in 10 years. And anyone who needs this will probably search for "asp.net core partitioned cookie" will find https://stackoverflow.com/a/77846869/719967 I don't understand the rush.

[BrennanConroy]

We might also want to check for options.SameSite == SameSiteMode.None && options.Secure && !options.Partitioned

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie

Warning: Cookies with the SameSite=None; Secure that do not also have the Partitioned attribute may be blocked in cross-site contexts on future browser versions. This behavior protects user data from cross-site tracking. See Cookies Having Independent Partitioned State (CHIPS) and Third-party cookies.