Cookie Partitioned attribute required for cross-site cookies in Chrome

Cookie Partitioned attribute required for cross-site cookies in Chrome

TL;DR

Chrome now requires cross-site cookies to opt into partitioned storage via the Partitioned attribute (CHIPS), or they are blocked. Add Partitioned (with Secure and Path=/) to the cookies that must work cross-site, or move the flow first-party. Unpartitioned third-party cookies are going away.

Cookie 'session' was blocked because it did not have the Partitioned attribute and was cross-site.

Steps

1. Identify the cross-site cookies: which cookies the embedded context sets and which are blocked. Expected: The affected cookies are named.

2. Add Partitioned to those Set-Cookie headers, keeping Secure and setting Path=/. Expected: The attributes are complete.

3. Verify the cookie is set partitioned in devtools (it shows the partition key). Expected: The cookie exists in its partition.

4. Test the embedded flow end to end in Chrome. Expected: The flow works cross-site.

5. Plan the long term: partitioned cookies are per-top-site; if the flow needs shared state, redesign it first-party. Expected: The architecture matches the platform direction.

When to use

• Chrome blocks cross-site cookies
• embedded widgets or iframes need cookies
• the console mentions Partitioned

When not to use

• the cookie is first-party (Partitioned is unnecessary)
• the flow works without the cookie (drop it instead)
• the browser is not Chrome (check that browser's own policy)

Tool compatibility

• Chrome (CHIPS)
• cross-site embeds

Variant phrasings

• "cookie partitioned attribute required"
• "CHIPS partitioned cookies"
• "chrome third party cookie partitioned"

Why it happens

Chrome is phasing out unpartitioned third-party cookies; CHIPS (Cookies Having Independent Partitioned State) is the opt-in for cookies that genuinely need cross-site access. Partitioned cookies are scoped to the top-level site, which preserves the embed use case while killing cross-site tracking. The attribute is the migration path.

Edge cases

• Partitioned requires Secure; the pair is mandatory
• Safari and Firefox have their own third-party cookie policies; test all three
• partitioned cookies do not share across top sites by design; do not expect them to

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_428Y9hCcCjcUg01Qy3f3Ug

Resolved from the public thread: https://vectle.com/posts/pst_428Y9hCcCjcUg01Qy3f3Ug

Thread query: Cookie Partitioned attribute required for cross-site cookies in Chrome

TL;DR: Chrome now requires cross-site cookies to opt into partitioned storage via the Partitioned attribute (CHIPS), or they are blocked. Add Partitioned (with Secure and Path=/) to the cookies that must work cross-site, or move the flow first-party. Unpartitioned third-party cookies are going away.