Safety
Partitioned Cookies vs SameSite=None for Embeds
January 20, 2025
Partitioned cookies vs SameSite=None is how browsers are shrinking the shared third-party jar. SameSite=None; Secure still lets an embed send one cookie on every site that frames you — a cross-site identity. The Partitioned attribute (CHIPS) stores that cookie in a jar keyed by the top-level site, so site A and site B do not share the embed's cookie. That is better for tracker-shaped embeds. It is not a reason to mark your main login cookie None+Partitioned. First-party sessions stay Lax or Strict without Partitioned. RoastMyOpsec grades Set-Cookie on the landing response. It does not load you inside third-party iframes or prove CHIPS behavior.
The practical difference
None means 'send this cookie in third-party contexts on HTTPS.' Partitioned means 'if you send it third-party, isolate it per top-level site.' Unpartitioned None is the old advertising model. Partitioned None is the embed that still needs a cookie but should not join a global profile.
If the cookie is your wordpress_logged_in or app session, neither None nor Partitioned is the first move — keep it first-party. See SameSite=None vs Lax.
How to choose based on the cookie's job
Login session: Lax/Strict, Host prefix, no Partitioned. Documented iframe embed that must remember a widget user: None; Secure; Partitioned; a dedicated name; still CSRF-defend state changes. Marketing pixel: prefer first-party analytics instead of a third-party cookie at all.
| Shape | Jar | When it wins | Takeaway |
|---|---|---|---|
| Lax / Strict session | First-party only (mostly) | Your site's login | Default |
| None; Secure | Shared across top-level sites | Legacy embeds you have not migrated | High CSRF and tracking cost |
| None; Secure; Partitioned | Per top-level site | Widget cookie that must exist in iframes | Better than unpartitioned None |
| Partitioned on the session cookie | Confused | Never | Don't |
What a URL roast can see
If the landing Set-Cookie includes Partitioned, the roast can note the attribute the same way it notes SameSite. Most session cookies will not show Partitioned — that is healthy. Third-party pixels may not even be on your origin.
Common mistakes
The first mistake is Partitioned as a substitute for Lax on the session cookie.
The second mistake is None without Secure, which browsers drop.
The third mistake is copying a CHIPS snippet onto every Set-Cookie.
Free audit the URL you own
RoastMyOpsec is a defensive public-surface roast: headers, cookies, sensitive paths, and more — no exploit payloads. Start with the free audit, then open the vault if the blurred findings look expensive.
Free audit nowFAQ
- Do I need Partitioned on my session cookie?
- No. Session cookies should be first-party Lax or Strict. Partitioned is for third-party embed cookies.
- Is Partitioned the same as SameSite=Lax?
- No. Lax limits when the cookie is sent. Partitioned changes which jar a third-party cookie uses. Different knobs.
- Does RoastMyOpsec test CHIPS in an iframe?
- No. It reads Set-Cookie on a consented GET to your URL. Confirm embed cookies in your own staging iframe.