Cookie Store API & Partitioned Cookies (CHIPS) Studio
Transition from legacy blocking document.cookie to the modern W3C cookieStore interface. Simulate CHIPS (Cookies Having Independent Partitioned State), analyze partitioned storage keys, and inspect cross-site tracking isolation across top-level domains.
1. Browsing Context & Cookie Specification
2. Browser Storage Jar & Partition Key Resolution
3. Production Async Cookie Store API Implementation
// TypeScript: Async CookieStore Operations with CHIPS
async function setPartitionedCookie(name: string, value: string) {
if (!('cookieStore' in window)) {
// Fallback to legacy document.cookie with Partitioned attribute
document.cookie = `${name}=${value}; Secure; SameSite=None; Partitioned; Path=/`;
return;
}
// Modern Asynchronous Non-Blocking Write
await window.cookieStore.set({
name: name,
value: value,
sameSite: 'none',
partitioned: true, // CHIPS Flag
expires: Date.now() + 30 * 86400 * 1000, // 30 Days
path: '/'
});
console.log(`[CookieStore] Set partitioned cookie '${name}' asynchronously`);
}
// Reactive Cookie Change Listener (Replaces Polling Loops!)
if ('cookieStore' in window) {
window.cookieStore.addEventListener('change', (event: any) => {
for (const cookie of event.changed) {
console.log(`Cookie modified: ${cookie.name} = ${cookie.value}`);
}
for (const cookie of event.deleted) {
console.log(`Cookie deleted: ${cookie.name}`);
}
});
}
⚠️ 5 Fatal Traps in Cookie Store & CHIPS Deployments
1. Setting 'Partitioned' Without 'Secure' or Over HTTP
The CHIPS specification strictly requires the Secure attribute. If a server issues Set-Cookie: token=123; Partitioned over plain HTTP or omits Secure, Chromium browsers will silently reject the entire cookie with no console warning.
2. Blocking the Main Thread with Giant 'document.cookie' Loops
Reading document.cookie requires the browser renderer process to make a synchronous IPC call to the browser storage process. When an application reads cookies inside a 60 FPS animation loop, each call causes 5ms to 15ms of main thread jank. Always migrate to await cookieStore.get().
3. Missing Fallbacks for Safari and Firefox
While Chromium fully supports the cookieStore global, Safari on iOS and macOS has not enabled the Cookie Store API by default. Production web applications must always feature-detect (if ('cookieStore' in window)) with a clean fallback to document.cookie.
4. Overlooking Partition Limit Evictions (Max 180 Cookies per Partition)
Chromium enforces an absolute maximum limit of 180 cookies per partition key, with a 10 KB total size cap. If an embedded widget creates dozens of tracking or state cookies, older cookies within that partition are evicted LRU, breaking user authentication without error notices.
5. Attempting to Share Partitioned Session State Across Top Domains
Developers accustomed to legacy third-party cookies frequently expect a single user login in an embedded chat widget on Site A to automatically persist when the user visits Site B. Under CHIPS, partitions are completely isolated. Cross-site login requires user activation via the Storage Access API.