MicrosoftEdge
[Problem/Bug]: DeleteCookie / DeleteCookies / DeleteCookiesWithDomainAndPath won't delete partitioned cookies
What happened?
Third-party websites may add cookies that are partitioned, as part of Chromium's CHIPS pattern. I've attempted to remove these cookies via the CoreWebView2CookieManager's DeleteCookie, DeleteCookies, and DeleteCookiesWithDomainAndPath APIs, but none of these will remove them. Only DeleteAllCookies successfully removes partitioned cookies, at the cost of also removing other cookies we'd prefer to keep.
Importance
Moderate. My app's user experience is affected, but still usable.
Runtime Channel
Stable release (WebView2 Runtime)
Runtime Version
126.0.2592.87
SDK Version
1.0.2535.41
Framework
Winforms
Operating System
Windows 11
OS Version
10.0.22631
Repro steps
Navigate to any website hosted by a WebView2 Winforms app. Open DevTools and enter the following commands in the console to add a normal and persistent cookie:
- cookieStore.set({ name: "Normal-Cookie", value: "normal-value", secure: true, path: "/", sameSite: "none" })
- cookieStore.set({ name: "Partitioned-Cookie", value: "partitioned-value", secure: true, path: "/", sameSite: "none", partitioned: true })
Still in DevTools, go to the Application tab, find your website's domain under the Cookies section, and note the cookie(s) you added.
In your WebView2 logic, obtain the cookie via the CoreWebView2CookieManager's GetCookiesAsync API, then attempt to remove it by using either the DeleteCookie, DeleteCookies, or DeleteCookiesWithDomainAndPath APIs.
Back in DevTools, refresh the cookies for your website. Notice that the while the normal cookie was removed, the partitioned cookie was not.
If you run the same workflow but clear the cookies using DeleteAllCookies, both the normal and partitioned cookies will be gone.
Repros in Edge Browser
No, issue does not reproduce in the corresponding Edge version
Regression
Don't know
Last working version (if regression)
No response
See https://github.com/MicrosoftEdge/WebView2Feedback/issues/4154#issuecomment-1815879308
@leonidukg Thank you! Using CDP to remove the cookie storage data for the partitioned cookie's domain works as a workaround.
Is there any update on this? We're starting to encounter issues even with the abovementioned workaround. We have a workflow where we'll delete all cookies then later conditionally re-add them. Thanks to the workaround we're successfully able to delete the cookies, but because the CoreWebView2Cookie class doesn't have any sort of Partitioned attribute, we're unable to re-add those partitioned cookies.
I recognize this isn't specifically about deleting partitioned cookies, but adding a CoreWebView2Cookie::Partitioned attribute would likely solve both the original issue and this new request.