New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 738326 link

Starred by 1 user

Issue metadata

Status: WontFix
Owner: ----
Closed: Jul 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

Chrome forgets all cookies quickly on some domains

Reported by marius.a...@gmail.com, Jun 30 2017

Issue description

UserAgent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.109 Safari/537.36

Steps to reproduce the problem:
I work with a lot of stores under same subdomain, eg.
store1.myshopify.com
store2.myshopify.com
store3.myshopify.com
...

After minutes or hours, I'm logged out, and cookies are lost on that domain, although expiration date is far in future.
It also happens on store1.com, store2.com ... (not just the subdomains)

I've tested Firefox for a few days, and there it works.
I've totally deleted my Chrome profile, and setup a new profile, it still happens.
Other sites don't lose cookies.

Do you have any idea about what could be the cause? Is there a cookie limit on a domain.com which affects all subdomains?

What is the expected behavior?
Have the cookies/session persist.

What went wrong?
Cookies on some subdomains are deleted after hours/minutes

Did this work before? N/A 

Chrome version: 59.0.3071.109  Channel: stable
OS Version: Fedora 23
Flash Version:
 

Comment 1 by kochi@chromium.org, Jun 30 2017

Components: Internals>Network>Cookies

Comment 2 by mmenke@chromium.org, Jun 30 2017

Cc: mkwst@chromium.org
There's a limit of 180 cookies per registry-controlled TLD.  Other browsers also have a limit (Ours used to be higher, but I'm not sure if that's still the case).  We have somewhat newer code that prefers to garbage collect non-secure cookies, which could also be the reason you're seeing different behavior with chrome.
Labels: M-59
Thanks for clarification (you might want to set the bug to Confirmed too?)

Could the limit be significantly raised in Chrome please? It's really impacting our work.
Appreciate it.

Cc: rdsmith@chromium.org
Status: WontFix (was: Unconfirmed)
Unfortunately not - 180 cookies (Which is reduce to 150 after GC) at 4k per cookie already gives nearly a MB of user storage for each site to work with (More, when you throw in various metadata associated with each cookie), and we store the DB in memory, for perf reasons.  Also, consider that this is a universal limit, and covers people in emrging markets with extremely low end devices and limited storage and memory.

This has been the limit for at least 5 years without a whole lot of issues.  Can't just update things for a couple sites having issues, since this can negatively impact a lot of users.  Also note that changing behavior of software on over a billion devices just for a couple sites neither scales, nor is it a good way to provide a consistent web API.

Unfortunately, this WontFix.  We could undoubtedly do better in our cookie implementation, but just turning up the limits isn't a way we plan to do that.  There are ways to deal with the limit (Shard domains, use a remote DB to map a user cookie to all accounts their signed in with, etc).
Other options are deleting unneeded cookies, setting higher cookie priority on those people need most / using ephemeral cookies for cookies that are not needed beyond the end of a session, or only setting a cookie when something changes relative to default behavior (You don't need per-user/site settings if the user hasn't actually changed them from default, for instance).

Anyhow, a lot of workarounds.

Comment 7 by mkwst@chromium.org, Jul 3 2017

I agree with mmenke@; the limits are already quite high, and raising them does have costs that we'd end up imposing on every Chrome user.

I also agree that cookie priorities are a reasonable way of dealing with the issue you're experiencing (https://tools.ietf.org/html/draft-west-cookie-priority-00). That's what Google uses for our internal network (which, for better or worse, is all running on subdomains of `google.com`).
Would it be possible to optimize which cookies are deleted, so that cookies on the current site we're working on are preserved? (delete from sites which were oldest accessed)

Chrome often removes cookies right on the current site we're working on, which is frustrating. Each site has ~6 cookies (but many sites)
store1.myshopify.com
store2.myshopify.com
store3.myshopify.com
...

example: When working on store3.myshopify.com, delete cookies from other sites.myshopify.com, but not from store3.

Thanks


Comment 9 by mkwst@chromium.org, Jul 24 2017

marius.andreiana@: The `priority` attribute (the document I linked in comment 7) does just that. Mark your important cookies as "high" priority, and they'll be removed after "low" and "default" priority cookies.

We should also be removing based on creation date within priority buckets: if `store3.myshopify.com` sets a cookie, it should be removed after cookies set from other subdomains.

Sign in to add a comment