Unable to create Partitioned cookie

[benfosterlitmos]

The Partitioned attribute is not set when passing the option to res.cookie().

https://developer.chrome.com/docs/privacy-sandbox/third-party-cookie-phase-out/#partitioned-cookies

[vladimiratanasov]

I am facing the same issue. Looking at the code, the project is using jshttp/cookie package to serialize the cookie to a string, and this downstream package does not support the partitioned flag. https://github.com/jshttp/cookie/blob/master/index.js#L111

There is a PR already to adopt this flag, let's hope for a quick turnaround jshttp/cookie#151

And another PR, with a more active maintainer jshttp/cookie#153.

[vladimiratanasov]

@dougwilson now that the partitioned property was adopted by jshttp/cookie, can it be updated here as well?

[andrewterry12]

Also interested in this. There is a time crunch as Google Chrome will begin blocking 1% of 3rd party cookies without this attribute in Q1 2024

[dougwilson]

Hello, our dependency recently added this, so it will get pulled in here in the next version. Apologies as it is currently a holiday time where I am, but will get a release spun up to include this asap.

[honohunter]

@dougwilson do you have any timeline for this upcoming release?

[dougwilson]

I am working on it right now, so it should be out within a few days at most 👍

[gorets]

Do you have a problem?

[dougwilson]

I'm sorry, I had to travel due to a death in the family and I keep getting bogus security vulnerability reports I have to keep triaging. I just got yet another one 30 mins ago. I am working as hard as possible. If I do not assess these and debate with the reporters or fix, they will file a CVE with no fix version and then chaos will ensue from everyone getting security reports, creating a bigger mess. I am working on express stuff right now even.

[vojvodics]

For anyone facing the same issue that needs the update before Express fixes it, there is a workaround:

1. Fix the version of the cookie package in package.json to 0.6.0. (Note: this may be unsafe to do if other packages depend on some lower version of the package. Do at your own risk)

"resolutions": {
  "cookie": "0.6.0"
}

2. If using typescript, add the following override

declare module "express-serve-static-core" {
  export interface CookieOptions {
    partitioned?: boolean;
  }
}

3. You should be able to use partitioned option

res.cookie("cookie-name", "cookie-value", { partitioned: true });

[morsssss]

@dougwilson sorry to hear about the difficulties you're going through. I would volunteer to boost the cookie dependency to 0.6.0, but I imagine there's more to do to make sure nothing breaks. Let me know though if I can help!

[imki123]

In my case, module "express" is working.

import { CookieOptions } from 'express'

declare module "express" {
  export interface CookieOptions {
    partitioned?: boolean;
  }
}

// something todo ...

It's working for me. I added secure: true, sameSite: 'none', partitioned: true.

const cookieOption = {
    httpOnly: true,
    secure: true,
    sameSite: 'none',
    partitioned: true,
  }

res.cookie(key, value, cookieOption)

[PascalPlantey]

Not working for me. I've set

  "overrides": {
    "cookie": "0.6.0"
  },

in package.json, and checked that the deployed production cookie version is 0.6.0 in node modules. I'm using cookie-parser and express

  const sessionConfig = {
    secret: process.env.COOKIE_SECRET,                                        // Secret utilisé par passport
    resave: false,
    saveUninitialized: false,
    cookie: {
      maxAge: 7 * 24 * 60 * 60 * 1000,                                        // 7 days : 7 * 24 * 60 * 60 * 1000
      resave: false,
      httpOnly: false,
      secure: PRODUCTION ? true : false,
      sameSite: PRODUCTION ? 'none' : '',
      partitioned: true
    },
  };

  app.set('trust proxy', 1);                                                  // Don't forward proxy but client's ip
  app.use(session({
    store: new pgSession({ pool: partnersDB.pool, }),                         // Une session DB à part sur le même pool
    ...sessionConfig,
  }));

but the cookies are still not partitioned. Is this due to cookie-parser or something else?

[vojvodics]

@PascalPlantey If you're using the https://github.com/expressjs/session package, they seem to be passing the cookie options manually (see https://github.com/expressjs/session/blob/master/session/cookie.js#L117-L138). So it would need to be fixed there