阅读中文版本

Third-Party Cookies and Storage Partitioning

Third-party cookies are set by an origin other than the one being visited, and modern browsers restrict or partition them to limit cross-site tracking.

Definition

A third-party cookie is a cookie issued in the context of an embedded resource whose origin differs from the top-level page, allowing that embedded origin to recognise the same browser across many sites.

The classification drives how analytics, embedded widgets, and federated login behave as browsers tighten cross-site storage. Compared to simpler alternatives, this concept fits best when the trade-off it represents is the one the system actually cares about.

When to use it

A common use case is applying it at the boundary where the cost of getting it wrong is highest, and the scenario usually involves a concrete guarantee the system must uphold. Unlike an ad hoc approach, it makes that guarantee explicit, reviewable, and testable.

How it works

Browsers decide third-party status from the context in which the cookie is read or written, so a cookie whose value is first-party on one site becomes third-party when the same origin is embedded elsewhere.

SameSite and storage partitioning split that state per top-level site, which breaks cross-site single sign-on unless a deliberate, standardised mechanism such as a supported federated flow is used.

Trade-offs and alternatives

Design for server-side identifiers or explicit user consent rather than ambient cookies, because the trend is toward ever narrower cross-site access. The main drawback is the extra complexity it introduces, so the benefit should clearly outweigh that cost before a team adopts it.

Common misconceptions

A persistent misconception is that all cookies are inherently third-party. Another is that SameSite alone makes a cookie invisible to the embedded origin. For example, an engineer who assumes otherwise may design around a guarantee that does not actually exist, which only becomes obvious under load or failure.

Anti-patterns to avoid

Two recurring anti-patterns are to relying on a shared embedded cookie for cross-site identity and to assuming partitioned storage shares state between top-level sites. Both tend to surface as hard-to-debug production issues rather than obvious test failures. Related concepts include Subresource Integrity (SRI), Preconnect and DNS-Prefetch Hints, Fetch Priority Signals.