Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Interoperability with document.cookie when all cookies are blocked #209

Open
tomayac opened this issue Sep 2, 2022 · 2 comments
Open

Interoperability with document.cookie when all cookies are blocked #209

tomayac opened this issue Sep 2, 2022 · 2 comments

Comments

@tomayac
Copy link

tomayac commented Sep 2, 2022

Consider the following code:

// All cookies are blocked in browser settings.

document.cookie = 'silently=ignored'; 
// > 'silently=ignored'
document.cookie;
// > ''

await cookieStore.set('throws', 'on-write');
// > Uncaught DOMException: An unknown error occured while writing the cookie.
await cookieStore.getAll();
// > []

To align with document.cookie's write behavior, should write operations for the Cookie Store API fail silently when cookies are blocked? The reading behavior is the same, both act as if there were no cookies by returning an empty string or an empty array respectively. The writing behavior is different, though.


Meta: Chrome's implementation misspells "occurred" (https://crbug.com/1359247).

@bsittler
Copy link
Contributor

I believe the failures in document.cookie writes are silent to avoid breaking too many older scripts written in an earlier era of no blocking that assume a write cannot fail. As a new API, cookieStore is not bound by that constraint. Similarly, cookie writes on a page whose storage access is deprived via content-security-policy: sandbox or by by virtue of being a data: URL do throw exceptions, since those are environments where such writing has never succeeded previously

@annevk
Copy link
Collaborator

annevk commented Jul 7, 2023

This concern seems similar to #182. As with that issue, I don't think parity with document.cookie on the setter side is important.

It does seem plausible you'll run into exceptions in certain corner cases, but if that becomes a big issue we can usually remove exceptions, whereas adding them later on is always impossible.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants