Proposal: Cookie Priorities

Mike West <> Thu, 03 March 2016 16:04 UTC

Return-Path: <>
Received: from localhost ( []) by (Postfix) with ESMTP id 1DF861A1BED for <>; Thu, 3 Mar 2016 08:04:18 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -6.385
X-Spam-Status: No, score=-6.385 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-0.006, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id a_tBA7DHte7k for <>; Thu, 3 Mar 2016 08:04:16 -0800 (PST)
Received: from ( []) (using TLSv1.2 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 02F9C1A1BD7 for <>; Thu, 3 Mar 2016 08:04:15 -0800 (PST)
Received: from lists by with local (Exim 4.80) (envelope-from <>) id 1abVeb-0002uM-Sw for; Thu, 03 Mar 2016 15:59:05 +0000
Resent-Date: Thu, 03 Mar 2016 15:59:05 +0000
Resent-Message-Id: <>
Received: from ([]) by with esmtps (TLS1.2:DHE_RSA_AES_128_CBC_SHA1:128) (Exim 4.80) (envelope-from <>) id 1abVeV-0002tW-RT for; Thu, 03 Mar 2016 15:58:59 +0000
Received: from ([]) by with esmtps (TLS1.2:RSA_ARCFOUR_SHA1:128) (Exim 4.80) (envelope-from <>) id 1abVeP-0005Qm-Pv for; Thu, 03 Mar 2016 15:58:59 +0000
Received: by with SMTP id bc4so28660999lbc.2 for <>; Thu, 03 Mar 2016 07:58:33 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20120113; h=mime-version:from:date:message-id:subject:to:cc; bh=9eSrMQ4c7K6w2oloSpjpv3mAEi+nd9njccNrt0DAbQQ=; b=kcco/VoZ+PEgIvMM09t3uRiVMnPb31doBUJGdCNpFjUaQjIy1sov36rqCCqbtbOtZU p9CLpO//221J/oiOI55t3IPJHrJyTASwjlfd5qnyQ1JSqwW+E/znho7dJ2tsBO6ub3SM xA3ARXuqDMybCbwqUMlyCGb57YREDfrLjUsUOcgj6pYoNYW2ALqmEBSefR7qH0mvwQe3 EVbOg432i/2gbsPjQQiNn+2Knh3RcsmOfikA12bsnvXCWFgNtjXYlUtMYj2P1VVjDuRH ChL3LXAy0aZoG6EbNolh5cI7vTUGQzCKTaCM88DKmlEynbuW6IdchMwLIvj4kVowuRGA tB5w==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20130820; h=x-gm-message-state:mime-version:from:date:message-id:subject:to:cc; bh=9eSrMQ4c7K6w2oloSpjpv3mAEi+nd9njccNrt0DAbQQ=; b=X0TCZ3JpNPXVTmR4XQP4i6jSo9uHtJRG1pITVYcocInDeIDQeR8Kkraldho1256Lov Co23dvHYQ31NQOT7jy3M6bqjYGHXrILJ2am3Ql5j6vMcuW9YrlixQIB97xBjXq7pLwy8 oTS4LYw1T6N6BGr1lXJUugT0i7Yb8syoHxFPRfVbO3/MGhyGFlrLcb0OBa1aPHeQ2XaC YCZcMytYM2j2qMUaLLsNlzAOSB6anqRsQy5YgU7Qgz39zXeDkfBWHWe/rYHVKeTtfnCC PUR8aFdMZhGhXSOIS6uqTdqzyiM7BGaafBA/zaO+fM5l5zlvP4vf/7iotehx92yO0m6Z b6LQ==
X-Gm-Message-State: AD7BkJLIAFamTp326uOGTqkWtd7yPoHzvU2Sh074lOKSnhwy6wY4H6JRDyULz4/FF8UWKj+uz76ejmbuksUZwcEz
X-Received: by with SMTP id h69mr1347361lfe.8.1457020706597; Thu, 03 Mar 2016 07:58:26 -0800 (PST)
MIME-Version: 1.0
Received: by with HTTP; Thu, 3 Mar 2016 07:58:06 -0800 (PST)
From: Mike West <>
Date: Thu, 03 Mar 2016 16:58:06 +0100
Message-ID: <>
To: HTTP Working Group <>
Cc: Samuel Huang <>, Mark Nottingham <>
Content-Type: multipart/alternative; boundary="001a11401b3ca6069e052d271191"
Received-SPF: pass client-ip=;;
X-W3C-Hub-Spam-Status: No, score=-7.9
X-W3C-Hub-Spam-Report: AWL=1.840, BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, W3C_AA=-1, W3C_DB=-1, W3C_IRA=-1, W3C_IRR=-3, W3C_WL=-1
X-W3C-Scan-Sig: 1abVeP-0005Qm-Pv f1fa26d24275fb3a6554058c1bcb9ee2
Subject: Proposal: Cookie Priorities
Archived-At: <>
X-Mailing-List: <> archive/latest/31164
Precedence: list
List-Id: <>
List-Help: <>
List-Post: <>
List-Unsubscribe: <>

Way back in 2013, folks at Google put together a proposal for a `priority`
attribute for cookies with the intent of allowing servers to influence a
user agent's retention policy[1]. Chrome has been shipping this feature
since ~November 2013[2], and Google servers have been using it since then.
It would be lovely to get more feedback on the concept from other folks
outside the company, so I've just submitted a copy/pasted version of the
original proposal[3] as Apologies for
the years of delay. :/

Like many other excitingly huge companies, Google has both internal and
external servers hosted on subdomains of ``, and employees hit
the user agent's cookie retention limit on a regular basis. In order to
insure that this doesn't result in lost sessions, Google marks certain
cookies as `Priority=High`, and others as `Priority=Low`. As you might
imagine, the latter are evicted more frequently than regular cookies, the
former less frequently. The document describes how Chrome takes these
priorities into account when evicting cookies from the cookie store.
Anecdotally, folks internally have found it quite helpful in terms of
retaining session state.

There's still some work to do to bring the document up to date with
proposals like which also
aim to alter the browser's eviction policy. I'm working through the
implications of that document on this proposal in Chrome right now, and
will document whatever merger we end up considering sane once we figure out
what it it might be. :)

One of the original authors (Erik) has left Google, and I haven't been
successful at getting in contact with him: I'm hopeful that we can get him
involved again. Regardless, Samuel and I would be thrilled to hear what
this group thinks of the proposal.