Untagging security team due to lack of bandwidth for engineering work on lower priority bugs. It would be great if the Mediawiki Platform Team could take a look at this.

I don't see how this is even remotely a security issue. In general, these tasks should probably be handled by the owners of the cookies (Data-Persistence in this case I guess?) - if it's OK that the cookie is not sent in cross-site requests set SameSite=Lax or just ignore the warning, if it's not OK (probably isn't in this case) set SameSite=None. But it would be nice if the task could be made public first.

This is definitely not a Data persistence team issue, we don't own cookies for third party systems. Not even sure about our own prod.

UseDC is part of ChronologyProtector which is definitely not third party (not sure there are multi-DC MediaWiki installations other than Wikimedia). UseCDNCache wasn't either but got removed a while ago (rMW497f3f1359d6: Remove redundant and unused UseCDNCache cookie).

Apparently the RDBMS library is owned by API Platform (which is a bit weird, but OK) so tagging them instead.

it looks to me like this is still a pending issue, and that a small patch to https://gerrit.wikimedia.org/g/mediawiki/core/+/472b691fb3dba77a298eb3a23fd2aa58edae75ba/includes/MediaWikiEntryPoint.php#354 to add the Secure flag and also the SameSite attribute with "none" value, might do it. But I'm not at all familiar with ChronologyProtector, there could well be context I don't have.

In T353649#12106930, @ArielGlenn wrote:

it looks to me like this is still a pending issue, and that a small patch to https://gerrit.wikimedia.org/g/mediawiki/core/+/472b691fb3dba77a298eb3a23fd2aa58edae75ba/includes/MediaWikiEntryPoint.php#354 to add the Secure flag and also the SameSite attribute with "none" value, might do it. But I'm not at all familiar with ChronologyProtector, there could well be context I don't have.

That sounds reasonable.

Change #1313463 had a related patch set uploaded (by ArielGlenn; author: ArielGlenn):

[mediawiki/core@master] Make the UseDC cookie work across different domains

https://gerrit.wikimedia.org/r/1313463

Change #1313463 merged by jenkins-bot:

[mediawiki/core@master] Make the UseDC cookie work across different domains

https://gerrit.wikimedia.org/r/1313463

Once this change has gone around to all wiki deployment groups, this task can be closed, so likely at the end of the week.

In T353649#12277548, @ArielGlenn wrote:

Once this change has gone around to all wiki deployment groups, this task can be closed, so likely at the end of the week.

For typical MediaWiki patches, we move the task to "Demo ready" once everything has been merged.