net/http: support partitioned cookies

[islishude]

The proposal is to add a new Partitioned bool field to the Cookie struct, set and used as follows:

In the Cookie parser, if the cookie says “; Partitioned”, the bool is set to true.

In Cookie.String, if Partitioned is true, the string adds “; Partitioned”.

In Cookie.Valid, if Partitioned is true and the cookie is not secure, Valid returns an error.

ref:

https://developer.chrome.com/docs/privacy-sandbox/third-party-cookie-phase-out/

[ianlancetaylor]

CC @neild @bradfitz

It would help a lot if you could say more about exactly what should change in the Go package. Thanks.

[islishude]

Sure, updated.

[gopherbot]

Change https://go.dev/cl/526435 mentions this issue: net/http: add paritioned attribute to cookie type

[neild]

We don't want a deprecation notice on SameSiteNoneMode. Browsers may not support it, but the net/http package should support sending SameSite=None if the user wants to.

Also, partitioned cookies use SameSite=None, so browsers haven't actually deprecated this value.

Adding a Partitioned field to http.Cookie seems reasonable:

type Cookie { // contains existing fields
  Partitioned bool
}

[islishude]

@neild I'm agree with you. my pr just adds a note for the SameSiteNoneMode.

[iamdlfl]

Any updates on this proposal? It would be useful for something I'm trying to work on.

[gregwebs]

What more needs to be done to have this proposal accepted? The associated commit explains the changes clearly.