On Wed, May 29, 2024 at 5:02 PM 'Dylan Cutler' via blink-dev < blink-dev@chromium.org> wrote:
> Hello Blink API Owners, > > > We’re seeking approval to unship and relaunch CHIPS (a.k.a. partitioned > cookies) in Android WebView only. > > Rationale > > The WebViewClient supports a method, shouldInterceptRequest > <https://developer.android.com/reference/android/webkit/WebViewClient#shouldInterceptRequest(android.webkit.WebView,%20android.webkit.WebResourceRequest)>, > which allows developers to intercept network activity and modify HTTP > headers, etc. This API does not have access to the Cookie header and relies > on the Android CookieManager API > <https://developer.android.com/reference/android/webkit/CookieManager> in > order to query what cookies are available for a particular request URL. > This is because the request is intercepted before it is sent to the > network service > <https://source.chromium.org/chromium/chromium/src/+/main:android_webview/browser/aw_contents_io_thread_client.cc;l=316;drc=59ac8227c5dd59754331b3f7f9f85e1a947f1242>, > where the Cookie header is added. However, partitioned cookies are > double-keyed on the top-level site and the site of the URL using the > cookies. > > Currently, the CookieManager API provides no way for developers to query > partitioned cookies correctly, and this will cause a mismatch between what > the Java API returns and what frames in WebView will actually be in their > Cookie header. In hindsight, this seems risky and prone to bugs, and not > something the CHIPS team had considered while designing the API. > > After discussing this with the WebView team, we believe that the option > that will minimize potential app breakage is to disable CHIPS on WebView > until we are able to ship support for the Cookie header to > shouldInterceptRequest. We will release the changes to > shouldInterceptRequest in the next target SDK version (API level 36). > > We will reconsider our decision to unlaunch CHIPS in WebView if we get > feedback from the community that this would cause significant disruption. > > Behavior after deprecation: > > Cookies set with the Partitioned attribute on WebView will have the > attribute ignored, and the cookie will be treated as unpartitioned. Any > existing partitioned cookies created in WebView will be deleted to avoid > conflicts across different partitions and the unpartitioned cookie jar. > This sounds like a pretty noticeable breakage. Are there any estimates on how many apps/users/developers would be impacted by this change? Also, as a point of process, I think this may require an intent to deprecate and remove in the chromestatus, although because this is only for WebView, I'm not entirely sure if there's a precedent. Thanks! Vlad > > All other platforms besides WebView will still have the Partitioned > attribute enabled. > > Timeline: > > We plan to turn down CHIPS on WebView in M127. > > We will relaunch CHIPS along with Android W, which will include changes to > the Android CookieManager API, in 2025. > > > Thanks, > > Dylan Cutler > > -- > You received this message because you are subscribed to the Google Groups > "blink-dev" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to blink-dev+unsubscr...@chromium.org. > To view this discussion on the web visit > https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CAMCNMFQOPkYjRxrs68q%2BHxebt-JWCopZ6Rq9r0O80dQF8PWwRg%40mail.gmail.com > <https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CAMCNMFQOPkYjRxrs68q%2BHxebt-JWCopZ6Rq9r0O80dQF8PWwRg%40mail.gmail.com?utm_medium=email&utm_source=footer> > . > -- You received this message because you are subscribed to the Google Groups "blink-dev" group. To unsubscribe from this group and stop receiving emails from it, send an email to blink-dev+unsubscr...@chromium.org. To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CADsXd2Nzwi3e-_18bPErm3HAGzdZLkT1VZ9wTmBZOAT8Vpp95w%40mail.gmail.com.
