,
4 tweets,
2 min read
Read on Twitter
1/ in this thread i'll summarize some differences between SameSite=Lax (Chrome's new proposed default policy; see mikewest.github.io/cookie-increme… for more technical details) and third party cookie blocking (Brave's default policy unless user turns it off for a site)
2/ SameSite=Lax is more strict than 3p cookie blocking in the sense that it also blocks requests using unsafe HTTP methods. For instance if X contains a form that POSTs to Y, cookies to Y would be blocked by SameSite=Lax but not most 3p cookie block implementations AFAIK
3/ SameSite=Lax is less strict than 3p cookie blocking in the sense that a site can override it with SameSite=None. But unless a site does that, both SameSite=Lax and 3p cookie blocking will block 3rd party cookies on subresource requests.
4/ my ideal cookie behavior would probably be:
1. 3p cookies blocked by default as well as w/ unsafe HTTP methods
2. User can override 1, at which point SameSite=Lax applies by default and sites can override this with SameSite=Strict/None
3. Require Secure flag for SameSite=None
1. 3p cookies blocked by default as well as w/ unsafe HTTP methods
2. User can override 1, at which point SameSite=Lax applies by default and sites can override this with SameSite=Strict/None
3. Require Secure flag for SameSite=None
