Skip to content

chore(cmd/anubis): enable Partitioned flag by default - #1797

Merged
Xe merged 1 commit into
mainfrom
Xe/partitioned-cookies
Aug 4, 2026
Merged

chore(cmd/anubis): enable Partitioned flag by default#1797
Xe merged 1 commit into
mainfrom
Xe/partitioned-cookies

Conversation

@Xe

@Xe Xe commented Aug 4, 2026

Copy link
Copy Markdown
Contributor

This is probably gonna bite someone somewhere, but I am told that this fixes the random Anubis cookie rejections. I am not able to reproduce this reliably despite many months of trying and assurances that this default configuration is broken.

Let's see how it fails in the real world, I guess.

Closes: #1701

Checklist:

  • Added a description of the changes to the [Unreleased] section of docs/docs/CHANGELOG.md
  • Added test cases to the relevant parts of the codebase
  • Ran integration tests npm run test:integration (unsupported on Windows, please use WSL)
  • All of my commits have verified signatures

This is probably gonna bite someone somewhere, but I am told that this
fixes the random Anubis cookie rejections. I am not able to reproduce
this reliably despite many months of trying and assurances that this
default configuration is broken.

Let's see how it fails in the real world, I guess.

Closes: #1701
Signed-off-by: Xe Iaso <[email protected]>
@Xe

Xe commented Aug 4, 2026

Copy link
Copy Markdown
Contributor Author

I am waiting for a chromesweep pass to run locally before I merge this.

@Xe

Xe commented Aug 4, 2026

Copy link
Copy Markdown
Contributor Author

Anubis image: ttl.sh/techaro/pr-1797/anubis:24h

Anubis policy results

policy status versions passed
default-config fail 21/23
fast fail 21/23
metarefresh fail 21/23
preact fail 21/23

Chrome 95 and 100 seem to fail. Will investigate after I merge into main.

@Xe
Xe merged commit 7640d89 into main Aug 4, 2026
24 checks passed
@karanshukla

Copy link
Copy Markdown

Thanks again for this! I'll keep an eye out and see if it breaks anything for my use case.

Xe added a commit that referenced this pull request Aug 4, 2026
Cookies are horrible: a rant by Xe Iaso.

Cookies are horrible. When cookies are sent from server to client, they
include a number of settings that I mistakenly let administrators
control. Turns out that when the browser stores them, they uniquely
identify cookies by the combination of both name and settings. These
settings are not sent back to the server upon requests. As a result, if
any administator changes any cookie setting without changing the cookie
name, the client sends two cookies. This is not good because the server
tries to clear the errant cookie, but the client discards that because
it doesn't match what the server sent.

To fix this, cookies are now dynamically renamed based on cookie
settings. This behaviour cannot be disabled.

Ref: #1797
Ref: #1701

Signed-off-by: Xe Iaso <[email protected]>
@Xe

Xe commented Aug 4, 2026

Copy link
Copy Markdown
Contributor Author

@karanshukla based on initial testing you want to make sure you bring in this patch: #1798

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

User blocked by default when using an in-app link.

2 participants