News for hackers. Stuff that matters.
Re:GitHub is adding web cookies for enterprise users by WatchDog on Tuesday August 02, 2022 @10:58PM (#32327135)
Payment gateway integrations might be one of the few legitimate non-advertising use cases I can think of for 3rd party cookies.

What makes you say they don't need them?

Re:GitHub is adding web cookies for enterprise users by lopatin on Tuesday August 02, 2022 @11:00PM (#32327148)
Do you mean that if you reject the cookie then the transaction will fail?
Re:GitHub is adding web cookies for enterprise users by WatchDog on Tuesday August 02, 2022 @11:57PM (#32327495)
I worked for a payment gateway years ago, when safari rolled out their initial blocking of third party cookies back in 2013 it broke some of our transaction flows yes.

There are a bunch of different kinds of payment gateway integrations, with various tradeoffs.

However a common pattern, at least at the time, was to use an iframe with the payment form in it.

Our form was multi page, and used cookie based sessions to track state between pages, so when they started being blocked, the payment form stopped working for safari users. The solution we chose at the time was to put the session id into the URL, but that has it's own security issues. There are other ways to address that particular issue that don't involve cookies, but would have required a significant rewrite of the system.

Some potentially legitimate ongoing use cases for 3rd party cookies, would be remembering payment details, and one click checkout across various sites that use the same payment gateway.

Re:GitHub is adding web cookies for enterprise users by pbreit on Friday August 12, 2022 @03:19AM (#32435494)
Wouldn't those be "necessary cookies"?
Re:GitHub is adding web cookies for enterprise users by lokedhs on Tuesday August 02, 2022 @11:16PM (#32327241)
If the use is required for the site to function, the data may be shared. The only ones you can reject are the ones that are not necessary, which usually involves ad trackers and similar things.

It should also be noted that these popups are likely not legal (or rather, they probably don't constitute informed consent under the the GDPR), but that's a completely different discussion to be had.

Re:GitHub is adding web cookies for enterprise users by pbreit on Friday August 12, 2022 @03:18AM (#32435488)
What 3rd party cookie is needed to process a payment? It's obnoxious I have to take care of the cookie situation what seems like every time I start a PayPal payment flow.
Re:GitHub is adding web cookies for enterprise users by closewith on Wednesday August 03, 2022 @01:03AM (#32327845)
If you actually needed the third-party cookie, it would be classed as strictly necessary and the site wouldn't need to ask for your consent.