Testing locally with 3rd-party cookies disabled and site data enabled

[vanvodk]

I was reading this Chrome blog post - origin trial from 2022 and try to test my current production site to see any impact.

1. Am I correct that even though I follow all the steps, I will have to wait for new Origin Trials as previous sessions has ended? Is there a experiment flag that I can turn on locally and simulate how Chrome works like after privacy sandbox released?
2. I noticed that Chrome cookie setting "Block third-party cookies" also block site data including localStorage? Is it expected? Is it how it works after privacy sandbox released?
   For example:
   There are 2 sites, a.com and b.com which is embedded in a.com as an iframe, a.com loaded but b.com did not. There is an error log saying Failed to read the 'localStorage' property from 'Window': Access is denied for this document.

I know that Partitioning using "double keyed" is applied to site data but since a.com has no intentions to retrieve b.com site data. Why did Chrome blocks site b.com to access localStorage on its own site?

[miketaylr]

2. I noticed that Chrome cookie setting "Block third-party cookies" also block site data including localStorage? Is it expected? Is it how it works after privacy sandbox released?

Yes, this is the current expected behavior (and has been for a few years). We plan to enable partitioned storage even when 3P cookies are blocked in a future release.

[miketaylr]

FYI, as of Chrome 119, partitioned storage is enabled when 3P cookies are blocked.

[vanvodk]

Hi @miketaylr
Will Chrome still allow users to change their cookie settings after this whole 3PC phase-out thing is rolled out (Q1 2024)? I refer to this Allow or block third-party cookies guideline.

I suppose that the only change regarding chrome://settings/cookies is that the default setting will be Block third-party cookies instead of Block third-party cookies in Incognito mode. Is it a correct statement?

[miketaylr]

Hi @vanvodk - we should have more to announce on this soon. Thanks.

[krgovind]

1. Am I correct that even though I follow all the steps, I will have to wait for new Origin Trials as previous sessions has ended? Is there a experiment flag that I can turn on locally and simulate how Chrome works like after privacy sandbox released?

Yes, every API does indeed have a flag that you can enable to test locally. I would recommend looking at the developer article corresponding to the API. For example, see First-Party Sets testing instructions.

2. I noticed that Chrome cookie setting "Block third-party cookies" also block site data including localStorage? Is it expected? Is it how it works after privacy sandbox released?

@miketaylr shared our expected shipping behavior in a previous comment. I wanted to add that in order to enable developers to test third-party cookie blocking with storage partitioning enabled, we are in the process of developing a command-line switch for local testing. Please see the tracking bug: crbug.com/1441039. The flag is available starting M115, but we are in the process of adding the storage partitioning behavior to it. We're hoping to make this available starting Chrome 116. The change should be available on the dev channel in a couple of weeks.

[vanvodk]

Yes indeed. Thanks for your help!

[vanvodk]

@krgovind I just happened to see that the crbug.com/1441039 is Fixed (Close). Is there any release channel that I can use to test it out? I used Chrome Canary to test it out but it doesn't seem to work.

[krgovind]

The flag is available starting Chrome 115. It did get recently renamed to --test-third-party-cookie-phaseout though. How are you using it on the command-line exactly?

[vanvodk]

I ran this command on Windows Terminal

--test-third-party-cookie-phaseout --enable-features="FirstPartySets,StorageAccessAPI,StorageAccessAPIForOriginExtension,PageInfoCookiesSubpage,PrivacySandboxFirstPartySetsUI" `
--use-first-party-set="{\"primary\": \"https://first-party-sets.glitch.me\", \"associatedSites\": [\"https://fps-member-1.glitch.me\"]}" `
https://first-party-sets.glitch.me/

and the Google test sites shown me this

I also got this error log from the developer console after clicking on "Click for cookies" option. I suppose that requestStorageAccessFor should not return any exception. Is it a correct statement? Or am I misunderstanding?

[DCtheTall]

Hello @vanvo1412 thank you for filing this issue and apologies you are experiencing issues.

For the first screenshot, when I run Chrome Canary on version 117 with the command line you provided, I see "Third-pary cookies look like they're blocked" display a [PASS]. Could you please verify your Chrome version?

The second screenshot is indeed a bug in the command line switch functionality, thank you for pointing it out. I am working on a patch and until then, you can enable FPS by opening chrome://settings/cookies and after selecting "Block Third-Party Cookies" and clicking the "Allow related sites to see activity in the group" toggle will enable FPS.

[vanvodk]

Hello @DCtheTall, indeed I run the same Chrome Canary on version 117. But I was able to make it work using Chrome Beta on version 115. I expect Chrome Canary will get updated more frequently than Chrome Beta, and it will get all the patches that you mentioned there.

Even I do this, it does not work for until I tried Chrome Beta instead of Chrome Canary. In summary, it all works out when I use Chrome Beta

you can enable FPS by opening chrome://settings/cookies and after selecting "Block Third-Party Cookies" and clicking the "Allow related sites to see activity in the group" toggle will enable FPS.

[DCtheTall]

Hey @vanvodk thanks for verifying your version. It is indeed strange to us that it is working in Beta and not Canary. After thinking it over, here are a couple more things which may help us figure out the cause:

Can you send a screenshot of your chrome://settings/cookies pages for both your Canary and Beta instances?

Can you ensure your Canary does not have any settings allowlisting any domains from sending cookies when 3PC blocking is on? These allowlists in settings take priority over the 3PC blocking setting (see "Allow or block cookies for a specific site" on this page).

[vanvodk]

Hello @DCtheTall, my bad. Actually Chrome Beta and Canary work the same as expected. "Block Third-Party Cookies" and "Allow related sites to see activity in the group" were enabled in Chrome Canary while they are not in Chrome Beta. Here is the correction

1. "Block Third-Party Cookies" setting blocks both 3PC and browser storage while --test-third-party-cookie-phaseout only blocks 3PC
2. Both "Block Third-Party Cookies" and --test-third-party-cookie-phaseout throw the same exception on the test site. I expect I would see cross-site cookies after I press the button "Click for cookies", is it a correct statement?