Add Partitioned cookie attribute support for reactive servers

[aramired]

Affects: \spring-web-6.0.12.jar

---

Chrome is going to deprecate third party cookies in near future. There are some suggested ways to mitigate cross site issues depends on cookies

Cookies having independent partitioned state(CHIPS) is one of the proposals(https://developer.chrome.com/docs/privacy-sandbox/chips/).

To try it out in cookie parameters ResponseCookie not yet supported the partitioned parameter(spring-web/src/main/java/org/springframework/http/ResponseCookie.java)

For testing purposes tried extending httpcookie and created custom cookie class but to add that cookie in exchange response, they are expecting only of type ResponseCookie
spring-web/src/main/java/org/springframework/http/server/reactive/ServerHttpResponse.java - getCookies() and addCookie()

We have many integration applications depends on cross site cookies, we want to try it out how it impacts our applications. Expecting this support from Spring as early as possible

[svankamamidi]

We also have same issue

[rstoyanchev]

Even if you could pass a custom cookie class, it would still need to be adapted and passed to the underlying server, which would also need to support this. Have you worked out yet how ResponseCookie would need to change?

[aramired]

In ResponseCookie need a boolean attribute called partitioned similar to secure

private final boolean partitioned;

/**
* Add the "Partitioned" attribute to the cookie.
*/
ResponseCookieBuilder partitioned(boolean partitioned);

[bclozel]

Note: this is currently not supported by all major browsers and I haven't seen any proposal for this in Java Servlet containers.

[bclozel]

I'm going to close this issue for now since there is no official support from supported servers at this point. Adding a field to our ResponseCookie is not enough, we would need actual API offered by Servlet containers to support this. Also, broader support in the industry would be also a prerequesite in my opinion.

We can reopen this issue once those conditions are met.

[svankamamidi]

@bclozel This would be show stopper issue for us and for many once 3rd party cookies are not supported, kindly re-open it or suggest alternatives