3 ms·

This change makes a mockery of Google's commitment to a compatible web. There have been 5 SameSite drafts over two year. This change is strictly incompatible wi

This change makes a mockery of Google's commitment to a compatible web. There have been 5 SameSite drafts over two year. This change is strictly incompatible with two of the drafts that shipped in two different browsers (Chrome 66 and Safari 12). Users of LTS Linux distributions will find random websites broken because of this change. It's a great idea on paper, but by shipping so many incompatible versions in the draft stage, Google has virtually ensured breakage for certain user agent - service combos. They should have held the change for another 18 months.

rubbingalcohol 7y ago
Can you give some examples with specifics on how their changes are causing problems? I only recently became aware of the SameSite setting and was considering using it on my apps, but might hold off
- hirsin 7y ago
  If you have cookies that need to be read in a 3p context (federated auth for instance), you must UA sniff in order to figure out if setting samesite=none is going to break your cookies, do nothing, or be required for your cookies - just across three versions of Chrome. Then there are the apps that forked Chromium 66 and then renamed it, so you can't tell what version it is. We're planning to just break them, since it's impossible to tell what to do there.
- will4274 7y ago
  If you return SameSite=None to Chrome 66, it ignores the cookie entirely. If you return SameSite=None to iOS 12, it treats it as SameSite=Strict. At the time each software was written, the behavior was blessed by the spec ("None" wasn't yet a valid value).
  - cpeterso 7y ago
    Here is Google's current list of incompatible clients. Someone should write an npm or Python module that encapsulates all these exceptions so sites can decorate their cookies correctly without worrying about these details. https://www.chromium.org/updates/same-site/incompatible-clients https://www.chromium.org/updates/same-site/incompatible-clie...
Deimorz 7y ago
LTS Linux releases still get browser updates. The purpose of LTS is to continue getting updates for years, they're not frozen with old versions. Ubuntu 16.04 LTS currently has Chromium 77 and Firefox 69.

rubbingalcohol 7y ago

Can you give some examples with specifics on how their changes are causing problems? I only recently became aware of the SameSite setting and was considering using it on my apps, but might hold off

hirsin 7y ago
If you have cookies that need to be read in a 3p context (federated auth for instance), you must UA sniff in order to figure out if setting samesite=none is going to break your cookies, do nothing, or be required for your cookies - just across three versions of Chrome. Then there are the apps that forked Chromium 66 and then renamed it, so you can't tell what version it is. We're planning to just break them, since it's impossible to tell what to do there.
will4274 7y ago
If you return SameSite=None to Chrome 66, it ignores the cookie entirely. If you return SameSite=None to iOS 12, it treats it as SameSite=Strict. At the time each software was written, the behavior was blessed by the spec ("None" wasn't yet a valid value).
- cpeterso 7y ago
  Here is Google's current list of incompatible clients. Someone should write an npm or Python module that encapsulates all these exceptions so sites can decorate their cookies correctly without worrying about these details. https://www.chromium.org/updates/same-site/incompatible-clients https://www.chromium.org/updates/same-site/incompatible-clie...

Deimorz 7y ago

LTS Linux releases still get browser updates. The purpose of LTS is to continue getting updates for years, they're not frozen with old versions. Ubuntu 16.04 LTS currently has Chromium 77 and Firefox 69.