Partitioned Third Party cookies using CHIPS blocks cookie access to any popup window or new tab opened from within our embedded iframe [317188859]

Assigned

Bug

Status Update

No update yet.

Description

mk...@gmail.com

created issue #1

Dec 20, 2023 07:16PM

https://www.moneyguidepro.com

2. Partitioned third party cookies using CHIPS blocks cookie access to any popup window or new tab opened from within our embedded iframe. This breaks our site with a web origin of

https://www.moneyguidepro.com that is iframed by third party financial firms. Any popup window or new tab opened from within the iframe has cookie access blocked and therefore loses our browser session. Then instead of showing the correct content such as our Support Center or Financial Plan Results Details the user is redirected back to our homepage as a default landing when a session ends or is invalid.

3. Screenshot document is attached.

4. The site is used some in a managed enterprise setup but mostly on client facing financial websites.

Chrome-CHIPS-Third-Party-Cookies.pdf

1.5 MB

View

Download

Comments

am...@google.com <am...@google.com> #2Dec 20, 2023 09:04PM

Thanks for the report and screenshots. I can't reproduce this because I don't have a moneyguidepro.com account, but the steps in the PDF help illustrate the issue.

am...@google.com <am...@google.com> #3Dec 20, 2023 09:11PM

Reassigned to mk...@gmail.com.

Mike, could you confirm if this issue is fixed when the top-level site is added to "Sites allowed to use third-party cookies" in chrome://settings/cookies? (Looks like that would be [*.]pietech.com in your example)

mk...@gmail.com <mk...@gmail.com> #4
Restricted
Dec 20, 2023 10:11PM

Learn More

settings-cookies.png

126 KB

View

Download

mk...@gmail.com <mk...@gmail.com> Dec 21, 2023 12:39AM

Reassigned to am...@google.com.

am...@google.com <am...@google.com> #5Dec 21, 2023 05:42AM

Reassigned to 3p...@google.com.

Thanks for the instructions, I was able to reproduce the issue.

Because this flow happens in a popup, there is a chance this will be mitigated by 3PCD heuristics (https://github.com/amaliev/3pcd-exemption-heuristics/blob/main/explainer.md). I'm having trouble testing the effect right now, but the final heuristics behavior should be launched in the next few weeks.

For now, it looks like you're signing up for the deprecation trial - I would recommend continuing this process to ensure this is fully mitigated in the short term.

@johannhof FYI it looks like this embed is using client credentials, this might be another use case for treating them as user intent.

mk...@gmail.com <mk...@gmail.com> #6Dec 21, 2023 09:50AM

Yes, I am signing up for the deprecation trial. I will continue on that path also for now. Do you need to change the Verification Status of this case to something other than "Unable to complete verification" so I can be approved for the origin-trial token? Thanks, Mike

am...@google.com <am...@google.com> #7Dec 21, 2023 03:09PM

My bad, flipped the Status and assigned to the hotlist for handling the DT requests. Thanks!

mk...@gmail.com <mk...@gmail.com> #8Dec 21, 2023 06:53PM

Thank you!

mk...@gmail.com <mk...@gmail.com> #9Dec 27, 2023 07:02PM

I applied for a new

Issue 317898730

: Registration Approval Request for Third Party Cookie Deprecation with the web origin

https://moneyguidepro.com since we have many subdomains we need this for. I originally applied for

https://www.moneyguidepro.com which wouldn't allow this. Thanks, Mike Koontz

jo...@google.com <jo...@google.com> #10Mar 11, 2024 04:10PM

Hi Mike, I hope your DT integration went well. Have you thought about long term API based solutions to this? If https://www.moneyguidepro.com is usually visited and logged into by users in a top-level context as well as the embedded context you've shown, then there are a few options:

You could use the Storage Access API to request access to third-party cookies
You could replace your login step with FedCM as a native login UI

If this is not the case, you might want to consider switching to a popup based authentication instead of requiring an in-frame login, this will allow you to leverage the heuristics Anton mentioned and also open up the option of using the two APIs mentioned above.