Intent to Prototype: Delete-Cookie header

[Yoav Weiss (@Shopify)]

Contact emails

yoav...@chromium.org

Explainer

https://yoavweiss.github.io/delete-cookie/draft-deletecookie-weiss-http-00/draft-deletecookie-weiss-http.html#section-2

Specification

https://yoavweiss.github.io/delete-cookie/draft-deletecookie-weiss-http-00/draft-deletecookie-weiss-http.html

Summary

A header that would enable servers to delete cookies they receive without having to know the "path" or "domain" parameters with which these cookies were set.

Blink component

Internals>Network>Cookies

Motivation

Long-operating web sites can often find themselves dealing with "cookie cruft" - cookies that no longer have backend logic that corresponds with them. Such cookies may have been set at some point in the past with far-reaching expiration dates, and are now causing useless cookie bloat at best, or using up quotas at the expense of relevant cookies at worst Deleting cookies is possible today by setting their expiry date to one in the past, but that requires one to know the "domain" and "path" parameters with which the cookies were set. That is not something that can be passively observed on the server side by default.

Initial public proposal

https://lists.w3.org/Archives/Public/ietf-http-wg/2025JanMar/0164.html

TAG review

None.

This feature will be discussed at the HTTPWG. It's unclear to me if the TAG should also weigh in on this. 

TAG review status

Not started

Risks

Interoperability and Compatibility

This feature has no compatibility risk. It's also getting engagement at the HTTPWG, and no strong pushback, which makes me think its interop risk is low.

Gecko: No signal

WebKit: No signal

Web developers: No signals

Other signals:

WebView application risks

Does this intent deprecate or change behavior of existing APIs, such that it has potentially high risk for Android WebView-based applications?

None

Debuggability

None

Is this feature fully tested by web-platform-tests?

Yes

Flag name on about://flags

None

Finch feature name

None for now, but I'll add one.

Non-finch justification

None

Requires code in //chrome?

False

Estimated milestones

No milestones specified

Link to entry on the Chrome Platform Status

https://chromestatus.com/feature/5195868787179520?gate=5086227331809280

This intent message was generated by Chrome Platform Status.