Chrome forgets all cookies quickly on some domains
Reported by
marius.a...@gmail.com,
Jun 30 2017
|
||||
Issue descriptionUserAgent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.109 Safari/537.36 Steps to reproduce the problem: I work with a lot of stores under same subdomain, eg. store1.myshopify.com store2.myshopify.com store3.myshopify.com ... After minutes or hours, I'm logged out, and cookies are lost on that domain, although expiration date is far in future. It also happens on store1.com, store2.com ... (not just the subdomains) I've tested Firefox for a few days, and there it works. I've totally deleted my Chrome profile, and setup a new profile, it still happens. Other sites don't lose cookies. Do you have any idea about what could be the cause? Is there a cookie limit on a domain.com which affects all subdomains? What is the expected behavior? Have the cookies/session persist. What went wrong? Cookies on some subdomains are deleted after hours/minutes Did this work before? N/A Chrome version: 59.0.3071.109 Channel: stable OS Version: Fedora 23 Flash Version:
,
Jun 30 2017
There's a limit of 180 cookies per registry-controlled TLD. Other browsers also have a limit (Ours used to be higher, but I'm not sure if that's still the case). We have somewhat newer code that prefers to garbage collect non-secure cookies, which could also be the reason you're seeing different behavior with chrome.
,
Jun 30 2017
,
Jul 1 2017
Thanks for clarification (you might want to set the bug to Confirmed too?) Could the limit be significantly raised in Chrome please? It's really impacting our work. Appreciate it.
,
Jul 1 2017
Unfortunately not - 180 cookies (Which is reduce to 150 after GC) at 4k per cookie already gives nearly a MB of user storage for each site to work with (More, when you throw in various metadata associated with each cookie), and we store the DB in memory, for perf reasons. Also, consider that this is a universal limit, and covers people in emrging markets with extremely low end devices and limited storage and memory. This has been the limit for at least 5 years without a whole lot of issues. Can't just update things for a couple sites having issues, since this can negatively impact a lot of users. Also note that changing behavior of software on over a billion devices just for a couple sites neither scales, nor is it a good way to provide a consistent web API. Unfortunately, this WontFix. We could undoubtedly do better in our cookie implementation, but just turning up the limits isn't a way we plan to do that. There are ways to deal with the limit (Shard domains, use a remote DB to map a user cookie to all accounts their signed in with, etc).
,
Jul 1 2017
Other options are deleting unneeded cookies, setting higher cookie priority on those people need most / using ephemeral cookies for cookies that are not needed beyond the end of a session, or only setting a cookie when something changes relative to default behavior (You don't need per-user/site settings if the user hasn't actually changed them from default, for instance). Anyhow, a lot of workarounds.
,
Jul 3 2017
I agree with mmenke@; the limits are already quite high, and raising them does have costs that we'd end up imposing on every Chrome user. I also agree that cookie priorities are a reasonable way of dealing with the issue you're experiencing (https://tools.ietf.org/html/draft-west-cookie-priority-00). That's what Google uses for our internal network (which, for better or worse, is all running on subdomains of `google.com`).
,
Jul 24 2017
Would it be possible to optimize which cookies are deleted, so that cookies on the current site we're working on are preserved? (delete from sites which were oldest accessed) Chrome often removes cookies right on the current site we're working on, which is frustrating. Each site has ~6 cookies (but many sites) store1.myshopify.com store2.myshopify.com store3.myshopify.com ... example: When working on store3.myshopify.com, delete cookies from other sites.myshopify.com, but not from store3. Thanks
,
Jul 24 2017
marius.andreiana@: The `priority` attribute (the document I linked in comment 7) does just that. Mark your important cookies as "high" priority, and they'll be removed after "low" and "default" priority cookies. We should also be removing based on creation date within priority buckets: if `store3.myshopify.com` sets a cookie, it should be removed after cookies set from other subdomains. |
||||
►
Sign in to add a comment |
||||
Comment 1 by kochi@chromium.org
, Jun 30 2017