Deleting a cookie is awkward

[jakearchibald]

This may depend on #11

When I get cookies via getAll, it feels like I should just be able to pass them to delete rather than having to split the object up into multiple arguments.

[bsittler]

I think write operations for multiple cookies aren't quite atomic today,
since they come from distinct Set-Cookie: headers/document.cookie
writes/meta tags each processed separately, although read operations for
multiple cookies are (or at least should be), since they come from a single
Cookie: header/document.cookie read and should reflect a coherent
serialization.
On Mar 9, 2016 03:07, "Jake Archibald" notifications@github.com wrote:

This may depend on #11
#11

When I get cookies via getAll, it feels like I should just be able to
pass them to delete rather than having to split the object up into
multiple arguments.

—
Reply to this email directly or view it on GitHub
#12.

[jakearchibald]

I don't think I explained well in the OP.

I'm saying:

navigator.cookies.getAll().then(cookies => {
  navigator.cookies.delete(cookies[0]);
})

…should work, rather than having to split them out into other arguments. Although this may be another side-effect of this being un-map-like.

[bsittler]

I see. This would require knowing the path+domain for each returned cookie

[jakearchibald]

Yeah, very much linked to #11

[bsittler]

Note that Origin-Cookie (if/when that becomes real) makes all those problems disappear. However it's also not backward compatible and may even call for a separate JS API for reads, just as the draft RFC specifies a separate request header today although it shares the same header for setting cookies

[bsittler]

FYI this issue is still present in the more recent API now outlined in the explainer but I think that with sane defaults (mostly path=/ by default and omitted domain by default for write/delete operations, along with recommending __Host- and __Secure- and enforcing their properties in writes through this API) we can make progress toward cleaning up this mess.

[inexorabletash]

explainer link is bad in the previous comment - needs a ../blob/master/ path prefix

[bsittler]

Fixed, thanks!

[bsittler]

Hah! Apparently the content preview doesn't use base href

[pwnall]

@jakearchibald I've updated the explainer to reflect the current Chrome implementation plus planned additions. I plan to export cookie metadata in such a way that the use case you describe (pass get / getAll result to delete) works.

Thank you very much for your feedback here!