Limit client side cookie lifetime to 24 hours

[jumde]

Description

As part of ITP 2.3, Safari reduced the expiry of client side cookies to 24 hours. We should do the same:
https://webkit.org/blog/9521/intelligent-tracking-prevention-2-3/

[fmarier]

That ITP 2.3 blog post only refers to the previous change in ITP 2.2:

With ITP 2.2, when a webpage is navigated to from a domain classified by ITP and the landing URL has a query string or fragment, the expiry of persistent client-side cookies created on that page is 24 hours."

We responded to that by filtering the query string and removing known offenders. Capping all JS cookies to 24h might have a big usability impact.

From what I can tell, if Apple is limiting the lifetime of all JS cookies, then they haven't announced it publicly yet. In the absence of a query string params, they're still capping tracking JS cookies to 7 days (whereas we are capping all JS cookies at 7 days).

Until there are further changes in this space, I think we should leave the limit at 7 days to avoid introduce a potentially large source of webcompat issues.

[ryanbr]

Reminds me a user complaining about this recently;

https://community.brave.com/t/brave-overwrites-the-expiration-day-of-long-living-cookies-that-were-set-from-javascript/103416