PSA: Stripping TAB & SPACE from name & value passed to CookieStore methods

10 views
Skip to first unread message

Johann Hofmann

unread,
12:02 AM (4 hours ago) 12:02 AM
to blink-dev
In bug 437345480 (crrev.com/c/7713559) I updated the CookieStore methods to strip leading and trailing tab and space characters from Cookie names and values.

This aligns Chromium with the standardized default behavior already shipping in Safari and Firefox and fixes a bunch of WPTs.

While web-observable, the change is extremely unlikely to cause breakage because it makes the Cookie Store more lenient in accepting Cookies. The only hypothetical way this would break a website is if the site relied on rejected Promises from setting cookies with leading / trailing whitespace characters.

Out of an abundance of caution there's a feature flag for it (CookieStoreAPIWhitespaceStripping)

This is shipping in M148.

Thanks!

Johann
Reply all
Reply to author
Forward
0 new messages