Firefox shows me this in the console when I click Edit (with VE):
Cookie “VEE” will be soon rejected because it has the “sameSite” attribute set to “none” or an invalid value, without the “secure” attribute. To know more about the “sameSite“ attribute, read https://developer.mozilla.org/docs/Web/HTTP/Cookies
| Subject | Repo | Branch | Lines +/- | |
|---|---|---|---|---|
| Use mw.cookie instead of jquery.cookie | mediawiki/extensions/VisualEditor | master | +5 -7 |
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Open | None | T255366 SameSite cookie issues | |||
| Resolved | DLynch | T252597 Cookie “VEE” will be soon rejected because it has the “sameSite” attribute set to “none” or an invalid value, without the “secure” attribute. | |||
| Resolved | Tgr | T257936 Support the WebRequest / WebResponse SameSite behavior on the JS side |
The VEE cookie is used to remember the editor preference of non-logged-in users, so I guess that might stop working "soon". We should investigate "soon" but I don't think this is very urgent.
It seems like upstream is no longer maintained and they recommend switching to js-cookie. We should probably try to convert our code to use mw.cookie and then a fix could be centralized in that module?
Change 617495 had a related patch set uploaded (by DLynch; owner: DLynch):
[mediawiki/extensions/VisualEditor@master] Use mw.cookie instead of jquery.cookie
Yeah, the patch is just a necessary-step towards removing the error. Depending on how T257936 is resolved, there may or may not be any more changes needed in VE code, I guess.
Change 617495 merged by jenkins-bot:
[mediawiki/extensions/VisualEditor@master] Use mw.cookie instead of jquery.cookie
I can do that. rMWf8a7a1ace825: Support SameSite=None cookies intentionally did not provide a SameSite setting for all cookies, though, so presumably the JS logic would mirror that, and the calling code would have to be updated to specify SameSite=None.
We chat with the Growth team and determined that this will be unblocked by T257936 in mid October.
See https://www.mediawiki.org/wiki/Manual:SameSite_cookies#Browser_warnings. This error message can probably be safely ignored.
Filed T265703: Replace jquery.cookie with js-cookie in MediaWiki about the js-cookie issue.
Because @Tgr has a fix for the underlying issue in T257936: Support the WebRequest / WebResponse SameSite behavior on the JS side, and because he thinks that the error described on this task can be ignored, we don't think this task actually needs work. Sending it back to the Editing team to check that out.
If this becomes an issue it will be sitewide and noticeable, and at that time we will reopen this task. This decision was collectively made in an Editing team meeting.