HTTP cookie: Difference between revisions

Revision as of 03:48, 26 August 2024

Revision as of 06:19, 4 October 2024

Line 40:

A ''persistent cookie'' expires at a specific date or after a specific length of time. For the persistent cookie's lifespan set by its creator, its information will be transmitted to the server every time the user visits the website that it belongs to, or every time the user views a resource belonging to that website from another website (such as an advertisement).

For this reason, persistent cookies are sometimes referred to as ''tracking cookies''<ref>{{Cite journal |lastlast1=Bujlow |firstfirst1=Tomasz |last2=Carela-Espanol |first2=Valentin |last3=Lee |first3=Beom-Ryeol |last4=Barlet-Ros |first4=Pere |date=2017 |title=A Survey on Web Tracking: Mechanisms, Implications, and Defenses |url=httphttps://ieeexplore.ieee.org/document/7872467/ |journal=Proceedings of the IEEE |volume=105 |issue=8 |pages=1476–1510 |doi=10.1109/JPROC.2016.2637878 |issn=0018-9219|hdl=2117/108437 |hdl-access=free }}</ref><ref>{{Citation |lastlast1=Rasaii |firstfirst1=Ali |title=Exploring the Cookieverse: A Multi-Perspective Analysis of Web Cookies |date=2023 |work=Passive and Active Measurement |volume=13882 |pages=623–651 |editor-last=Brunstrom |editor-first=Anna |url=https://link.springer.com/10.1007/978-3-031-28486-1_26 |access-date=2024-08-24 |place=Cham |publisher=Springer Nature Switzerland |language=en |doi=10.1007/978-3-031-28486-1_26 |isbn=978-3-031-28485-4 |last2=Singh |first2=Shivani |last3=Gosain |first3=Devashish |last4=Gasser |first4=Oliver |editor2-last=Flores |editor2-first=Marcel |editor3-last=Fiore |editor3-first=Marco}}</ref> because they can be used by advertisers to record information about a user's web browsing habits over an extended period of time. Persistent cookies are also used for reasons such as keeping users logged into their accounts on websites, to avoid re-entering login credentials at every visit. {{Crossreference|selfref=no|(See {{section link||Uses}}, below.)}}

===Secure cookie===

Line 53:

The Same-site cookie is incorporated into a new RFC draft for "Cookies: HTTP State Management Mechanism"<ref>{{Cite report |url=https://datatracker.ietf.org/doc/draft-ietf-httpbis-rfc6265bis/07/ |title=Cookies: HTTP State Management Mechanism |last1=West |first1=Mike |last2=Wilander |first2=John |date=2020-12-07 |publisher=Internet Engineering Task Force |issue=draft-ietf-httpbis-rfc6265bis-07}}</ref> to update RFC 6265 (if approved).

Chrome, Firefox, and Edge started to support Same-site cookies.<ref name="sJzIz">{{Cite web|url=https://www.lambdatest.com/SameSite-cookie-attribute|title = Browser Compatibility Testing of 'SameSite' cookie attribute}}</ref> The key of rollout is the treatment of existing cookies without the SameSite attribute defined, Chrome has been treating those existing cookies as if SameSite=None, this would let all website/applications run as before. Google intended to change that default to <code>SameSite=Lax</code> in Chrome 80 planned to be released in February 2020,<ref name="QPJhf">{{Cite web|title=SameSite Cookie Changes in February 2020: What You Need to Know|url=https://blog.chromium.org/2020/02/samesite-cookie-changes-in-february.html|access-date=2021-04-05|website=Chromium Blog|language=en}}</ref> but due to potential for breakage of those applications/websites that rely on third-party/cross-site cookies and [[COVID-19]] circumstances, Google postponed this change to Chrome 84.<ref name="Ne4hV">{{Cite webnews|title=Temporarily rolling back SameSite Cookie Changes|url=https://blog.chromium.org/2020/04/temporarily-rolling-back-samesite.html|access-date=2021-04-05|website=Chromium Blog|language=en}}</ref><ref>{{Cite web |last=Schuh |first=Justin |date=2020-05-28 |title=Resuming SameSite Cookie Changes in July |url=https://blog.chromium.org/2020/05/resuming-samesite-cookie-changes-in-july.html |access-date=2024-02-18 |website=Chromium Blog |language=en}}</ref>

===Supercookie===

Line 210:

{{as of|2014}}, some websites were setting cookies readable for over 100 third-party domains.<ref name="BYMXD">{{cite web |url=http://webcookies.org/third-party-cookies/ |title=Third party domains |publisher=WebCookies.org |access-date=2014-12-07 |archive-url=https://web.archive.org/web/20141209234746/http://webcookies.org/third-party-cookies/ |archive-date=2014-12-09 |url-status=live}}</ref> On average, a single website was setting 10 cookies, with a maximum number of cookies (first- and third-party) reaching over 800.<ref name="cOnAw">{{cite web |url=http://webcookies.org/number-of-cookies/ |title=Number of cookies |publisher=WebCookies.org |access-date=2014-12-07 |archive-url=https://web.archive.org/web/20141209235956/http://webcookies.org/number-of-cookies/ |archive-date=2014-12-09 |url-status=live}}</ref>

The older standards for cookies, RFC 2109<ref name="RFC2109"/> and RFC 2965, recommend that browsers should protect user privacy and not allow sharing of cookies between servers by default. However, the newer standard, RFC 6265, explicitly allows user agents to implement whichever third-party cookie policy they wish. Most modern web browsers contain [[privacy settings]] that can [[ad blocker|block]] third-party cookies. Since 2020, [[Apple Safari]],<ref name="zw6bb">{{Cite web|last=Statt|first=Nick|date=2020-03-24|title=Apple updates Safari's anti-tracking tech with full third-party cookie blocking|url=https://www.theverge.com/2020/3/24/21192830/apple-safari-intelligent-tracking-privacy-full-third-party-cookie-blocking|access-date=2020-07-24|website=The Verge|language=en}}</ref> [[Firefox]],<ref name="GSofz">{{Cite web|date=2019-06-04|title=Firefox starts blocking third-party cookies by default|url=https://venturebeat.com/2019/06/04/firefox-enhanced-tracking-protection-blocks-third-party-cookies-by-default/|access-date=2020-07-24|website=VentureBeat|language=en-US}}</ref> and [[Brave (web browser)|Brave]]<ref name="sUPt1">{{Cite web|last=Brave|date=2020-02-06|title=OK Google, don't delay real browser privacy until 2022|url=https://brave.com/ok-google/|access-date=2020-07-24|website=Brave Browser|language=en-US}}</ref> block all third-party cookies by default. Safari allows embedded sites to use Storage Access API to request permission to set first-party cookies. In May 2020, [[Google Chrome]] 83 introduced new features to block third-party cookies by default in its Incognito mode for private browsing, making blocking optional during normal browsing. The same update also added an option to block first-party cookies.<ref name="xiHRq">{{cite web |last1=Protalinski |first1=Emil |title=Chrome 83 arrives with redesigned security settings, third-party cookies blocked in Incognito |url=https://venturebeat.com/2020/05/19/google-chrome-83/ |website=VentureBeat |access-date=25 June 2020 |date=19 May 2020}}</ref> In April 2024, Chrome postponed third-party cookie blocking by default to 2025.<ref>{{Cite web |last=Amadeo |first=Ron |date=2024-04-24 |title=Google can't quit third-party cookies—delays shut down for a third time |url=https://arstechnica.com/gadgets/2024/04/google-delays-third-party-cookie-death-again-now-scheduled-for-2025/ |access-date=2024-04-25 |website=Ars Technica |language=en-us}}</ref> In July 2024, Google announced plan to avoid blocking third-party cookies by default and instead prompt users to allow third-party cookies.<ref>{{Cite web |last=Lawler |first=Richard |date=2024-07-22 |title=Google’sGoogle's plan to turn off third-party cookies in Chrome is dying |url=https://www.theverge.com/2024/7/22/24203893/google-cookie-tracking-prompt-ad-targeting-privacy-sandbox |access-date=2024-07-29 |website=The Verge |language=en}}</ref>

==Privacy==