Skip to content

Minor edits to the "Third-party cookies" section #39388

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

DanKaplanSES
Copy link
Contributor

  • I think there was some issues with pluralization of the word "Cookie" at the end of this section, so I attempted to reword it.
  • I ended up changing more than I originally intended
  • I did not intend to change any of the original meaning. If I did, that was a mistake on my part.

- I think there was some issues with pluralization of the word "Cookie" at the end of this section, so I attempted to reword it.
- I ended up changing more than I originally intended
- I did not intend to change any of the original meaning. If I did, that was a mistake on my part.
@DanKaplanSES DanKaplanSES requested a review from a team as a code owner May 4, 2025 22:56
@DanKaplanSES DanKaplanSES requested review from hamishwillee and removed request for a team May 4, 2025 22:56
@github-actions github-actions bot added Content:HTTP HTTP docs size/xs [PR only] 0-5 LoC changed labels May 4, 2025
Copy link
Contributor

github-actions bot commented May 4, 2025

Preview URLs

Flaws (1)

URL: /en-US/docs/Web/HTTP/Guides/CORS
Title: Cross-Origin Resource Sharing (CORS)
Flaw count: 1

  • unknown:
    • No generic content config found

Cookie in the request may also be suppressed in normal third-party cookie policies. The enforced cookie policy may therefore nullify the capability described in this chapter, effectively preventing you from making credentialed requests whatsoever.

Cookie policy around the [SameSite](/en-US/docs/Web/HTTP/Reference/Headers/Set-Cookie#samesitesamesite-value) attribute would apply.
Third-party cookie policies (e.g., the [SameSite](/en-US/docs/Web/HTTP/Reference/Headers/Set-Cookie#samesitesamesite-value) attribute) may suppress certain cookies from being sent to the server. The enforced cookie policy may therefore nullify the capability described in this chapter, effectively preventing you from making credentialed requests whatsoever.
Copy link
Collaborator

@hamishwillee hamishwillee May 4, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I prefer your version, but it does kind of change the "flow". How about this (for the whole section)

Suggested change
Third-party cookie policies (e.g., the [SameSite](/en-US/docs/Web/HTTP/Reference/Headers/Set-Cookie#samesitesamesite-value) attribute) may suppress certain cookies from being sent to the server. The enforced cookie policy may therefore nullify the capability described in this chapter, effectively preventing you from making credentialed requests whatsoever.
Cookies set in CORS requests and responses are subject to normal third-party cookie policies.
Third-party cookie policies may prevent third party cookies being sent in requests, effectively stopping a site from making credentialed requests even if permitted by the third party server (using `Access-Control-Allow-Credentials`).
The default policy differs between browsers, but may be set using the [SameSite](/en-US/docs/Web/HTTP/Reference/Headers/Set-Cookie#samesitesamesite-value) attribute.
Even if credentialed requests are allowed, a browser may be configured to reject all third-party cookies in responses.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Content:HTTP HTTP docs size/xs [PR only] 0-5 LoC changed
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants