Adds Partitioned (CHIPS) support for the session cookie#1680
Merged
jakobvogel merged 4 commits intoJul 14, 2026
Conversation
Introduces an opt-in http.sessionCookie.partitioned config that marks the client session cookie (and its pin cookie) with the Partitioned attribute. A partitioned cookie is stored and sent under a per-top-level-site partition, which lets the client session work inside a cross-site (third-party) iframe that browsers would otherwise block or partition away - for example an embedded support widget. It is only effective together with SameSite=None and a secure cookie; browsers ignore the attribute otherwise. The attribute defaults to false, so behaviour is unchanged unless a product opts in. Writing of the session and pin cookies is now funnelled through a single setSessionScopedCookie helper so both consistently carry the SameSite, security and Partitioned attributes. MIO-6543 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The session-value round-trip test strips the cookie attributes, so the setSessionScopedCookie refactor's attribute handling was previously only verified by code review. This asserts on the raw Set-Cookie that the session cookie is still marked HttpOnly (the attribute now set inside the new helper) and that it carries no Partitioned attribute while http.sessionCookie.partitioned defaults to false - guarding both against an accidental regression. MIO-6543 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Adds opt-in support for Partitioned (CHIPS) session cookies so client sessions can work reliably inside cross-site (third-party) iframes, while keeping default behavior unchanged.
Changes:
- Introduces
http.sessionCookie.partitionedconfig flag (defaultfalse) to emit thePartitionedcookie attribute for the session cookie and its pin cookie. - Refactors session/pin cookie writing through a shared helper to ensure consistent attributes (SameSite / Secure / Partitioned / HttpOnly).
- Adds a regression test asserting the session cookie remains HttpOnly and is not partitioned by default.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| src/test/kotlin/sirius/web/http/WebContextTest.kt | Adds regression test covering default (non-partitioned) session cookie attributes. |
| src/main/resources/component-065-web.conf | Documents and adds http.sessionCookie.partitioned configuration default. |
| src/main/java/sirius/web/http/WebContext.java | Adds config value and applies Partitioned attribute via new setSessionScopedCookie helper for session-related cookies. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
A Partitioned (CHIPS) cookie is rejected outright by browsers unless it is also Secure, and the attribute is only meaningful on a cookie that is actually sent cross-site (SameSite=None). Emitting it unconditionally meant that enabling http.sessionCookie.partitioned while the cookie was not secure (e.g. local HTTP development under the default secure = IF_SSL, or a misconfigured secure = NEVER) or not SameSite=None would produce an invalid cookie and break the session. The Partitioned attribute is now only set when the resulting cookie is both Secure and SameSite=None; otherwise it is silently skipped, so enabling the flag can never produce an invalid cookie. Addresses the Copilot review on the PR. MIO-6543 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
sabieber
approved these changes
Jul 14, 2026
| @@ -1566,12 +1572,33 @@ private void buildClientSessionCookie() { | |||
|
|
|||
Member
There was a problem hiding this comment.
Question: This has no usage left now, right?
fhaScireum
approved these changes
Jul 14, 2026
idlira
approved these changes
Jul 14, 2026
Contributor
There was a problem hiding this comment.
I would have done it the other way around, since this is needed in a HF: PR against main, later branch from your desired source tag and cherry-pick there, resolving any conflict that might arrive.
Another reason for that: since compile fail due to conflicts, test cases don't even run.
Brings origin/main into the branch so the PR can build the merged state and be merged cleanly. The only conflict was in WebContext#buildClientSessionCookie, where main's autoformat reformatted the setCookie(...) call that this branch replaces with setSessionScopedCookie; resolved in favour of this branch's version (setSessionScopedCookie for both the session and dated cookie paths). The hotfix tag 106.0.1-hf-1 was cut on a6ff917 before this merge, so it remains a clean 106.0.1 + delta unaffected by main's history. MIO-6543 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Adds an opt-in
http.sessionCookie.partitioned(CHIPS) config that marks the client session cookie and its session-pin cookie with thePartitionedattribute. A partitioned cookie is stored and sent under a per-top-level-site partition, which lets the client session work inside a cross-site (third-party) iframe — e.g. an embedded support widget — that browsers (Safari ITP, Firefox TCP, Chrome 3PCD) would otherwise block or partition away.false→ behaviour is unchanged for every existing product unless it enables the flag. Whenfalse,setPartitioned(false)is a genuine no-op (the encoder only emits; Partitionedwhen the flag is set), so no cookie changes on the wire.Securecookie; for the cross-site iframe use case it additionally has to be combined withSameSite=None.setSessionScopedCookiehelper, so both consistently carry the SameSite, Secure and Partitioned attributes (the pin cookie must share the session cookie's partition, or pinning would break when CHIPS is enabled).No breaking changes. Operational note when enabling: a partitioned session is scoped per top-level site (a session established under one embedding site is not shared with another) — this is the intended CHIPS behaviour.
Additional Notes
Checklist