Repository navigation
Layered Cookies integration #1826
Description
What is the issue with the Fetch Standard?
https://datatracker.ietf.org/doc/draft-ietf-httpbis-layered-cookies is the latest Cookies work at the IETF with the express goal of tackling httpwg/http-extensions#2084.
#1807 is the first step towards integrating that with Fetch. This will solve #693. It should also solve part of Storage Access' needs (though the remainder of that API will still need upstreaming to HTML).
Then we have these remaining pieces that all need some detailed attention:
- Cookie Store API integration. In particular due to the Cookie Store API having events, this comes with some difficulty.
-
Clear-Site-Dataintegration. This should be mostly straightforward work, but might require new hooks in the Cookies section (which the first step PR will introduce). - Service Workers integration. I believe some work is required here still, though not entirely sure.
Ideally we ensure that there's sufficient test coverage at each incremental point.
Activity
rifmj commentedon Nov 2, 2026
One more remaining piece: removing expired cookies.
Fetch calls "garbage collect cookies" only while processing
Set-Cookie, and nothing calls "remove expired cookies" otherwise. "Retrieve Cookies" has no expiry condition, because layered-cookies leaves this to Fetch and other callers (its "Requirements Specific to Browser User Agents" lists Remove Expired Cookies as a hook). So if noSet-Cookieis processed after a cookie expires, the steps return it:m=1; Max-Age=2, then a request 4 seconds later with no response in between.Chromium 156, Firefox 157 and WebKit 27.2 do not send it. This was already noted on #1807 ("clearing cookies periodically"), but it is not in the list above.
cookies/attributes/expired-at-read.htmlin web-platform-tests/wpt#64550 covers the request header anddocument.cookieseparately, and passes in all three. I found no WPT that waits for expiry.Drafted with AI help.