Cookies Having Independent Partitioned State (CHIPS)

Browsers are phasing out third-party cookies, and CHIPS (Cookies Having Independent Partitioned State) is a way to keep some of them working. A cookie marked Partitioned gets a separate cookie jar for each top-level site, so a service embedded on two sites can't use that cookie to track you across both. This RFC from Dmitrii Derepko and Niels Dossche adds a partitioned option to PHP's cookie and session functions.

Why change it#

PHP had no option for this, so frameworks and apps had to write the Set-Cookie header by hand. The feature was first requested in a php-src issue.

According to the RFC, Chromium-based browsers and Firefox support CHIPS. Firefox enabled it fully in version 141, and Safari added it in 18.4.

Show me#

setcookie("name", "value", ["secure" => true, "partitioned" => true]);

// will result in headers:
// Set-Cookie: name=value; secure; Partitioned

Only the array form of setcookie() and setrawcookie() gets the new option, which is how the samesite option was added too.

A partitioned cookie must also be secure, and leaving out secure throws an error:

setcookie("name", "value", ["partitioned" => true]);
// Uncaught ValueError: setcookie(): "partitioned" option cannot be used without "secure" option in ...

Sessions are covered as well:

session_set_cookie_params(["secure" => true, "partitioned" => true]);
session_start();

session_start() accepts a new cookie_partitioned option, and session_get_cookie_params() now returns a partitioned key. There's also a new session.cookie_partitioned ini setting, which is off by default.

For sessions, PHP checks the secure requirement when the session starts. If it fails, session_start() emits a warning and returns false. The check waits until then because the settings can come from several places, like ini_set().

What it means for existing code#

Nothing breaks, since the option is off unless you turn it on. C extensions that call the internal php_setcookie function get one extra argument.

The vote#

Accepted. Voting closed on August 12, 2025 with 25 in favor and none against, clearing the two-thirds majority it needed. It was merged into PHP 8.5.