From 8b7da3a3f34909d7ce0e488ee05064eb8ee385b9 Mon Sep 17 00:00:00 2001 From: Aaron Selya Date: Mon, 28 Oct 2024 16:28:16 -0400 Subject: [PATCH] Update draft-cutler-httpbis-partitioned-cookies.md Update language to cover some edge cases on ACB --- draft-cutler-httpbis-partitioned-cookies.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/draft-cutler-httpbis-partitioned-cookies.md b/draft-cutler-httpbis-partitioned-cookies.md index c57d5e6..47df29f 100644 --- a/draft-cutler-httpbis-partitioned-cookies.md +++ b/draft-cutler-httpbis-partitioned-cookies.md @@ -88,8 +88,9 @@ This algorithm could be added after {{Section 5.2 ("Same-site" and "cross-site" {:quote} > 1. Let top-document be the active document in document's browsing context's top-level browsing context. -> 2. Let "cookie-partition-key" be a tuple whose first element is the site of the top-document when the user agent made the request and the whose second element is a bit corresponding to a boolean value, indicating if the context the cookie was created in is cross-site as defined in [Section 5.2 of RFC6265bis](https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis-13#section-5.2). -> 3. If the cookie is being read or written via a "non-HTTP" API, then cookie-partition-key's first element, the site (as defined in {{HTML}}) used for the key, is same-site with the top-document associated with the non-HTTP API. +> 2. Let "cookie-partition-key" be a tuple whose first element is the site of the top-document when the user agent made the request and whose second element is a boolean (cross-site ancestor) indicating if the cookie was created in a cross-site context as defined in [Section 5.2 of RFC6265bis](https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis-13#section-5.2). +> 3. All cookies set on the top-document have a cross-site ancestor value indicating that they were set in a same-site context. +> 4. If the cookie is being read or written via a "non-HTTP" API, then cookie-partition-key's first element, the site (as defined in {{HTML}}), is the top-document associated with the non-HTTP API. If the origin assocaited with the cookie is not first-party to the site contained in the first element, the second element (cross-site ancestor) must have a value that corresponds to a cross-site context. ## Using Set-Cookie with Partitioned