Cookie Store API

[o-t-w]

Request for position on an emerging web specification

• WebKittens who can provide input:

Information about the spec

• Spec Title: Cookie Store API
• Spec URL: https://wicg.github.io/cookie-store/
• GitHub repository: https://github.com/WICG/cookie-store

Design reviews and vendor positions

• Mozilla standards-positions issue: Cookie-Store API mozilla/standards-positions#94

[othermaciej]

There is also a TAG review request here: w3ctag/design-reviews#290

[annevk]

This comment by Ehsan on the Mozilla issue still seems applicable and relevant:

Basically I think this API mostly achieves only one of the motivations stated in https://wicg.github.io/cookie-store/#intro-motivation, that is, providing cookie access to service workers, but as far as I can see doesn't really help address the other points mentioned in the Motivation section, such as lack of interoperability in processing cookies among browsers and divergent specs and UA behaviours. Perhaps I'm missing something but I believe if all major browsers just adopted the current Cookie Store API, it would help with none of the problems this research is highlighting for example: http://inikulin.github.io/cookie-compat/.

Another thing that makes me uncomfortable with the existing API is that it provides scripting access to new data about cookies which the platform currently doesn't provide (domain, path, expires, secure, and samesite). It is unclear to me if access to this extra data is completely OK, especially given the fact that it allows scripts to examine the properties of cookies set by scripts coming from another origin. The current spec is silent on any privacy implications. But I believe if Gecko would one day consider implementing this spec with the intention of shipping it, we should probably have a discussion about whether we'd like to expose this new data to the Web platform first.

Based on that I'm adding concerns: API design, concerns: complexity, and concerns: integration.