RESOLVED FIXED329139
Cookie expiry capping for CNAME cloaking should not apply to YouTube and Google first parties 
https://bugs.webkit.org/show_bug.cgi?id=329139
Summary Cookie expiry capping for CNAME cloaking should not apply to YouTube and Goog...
Ian Gower
Reported 2026-10-27 12:04:15 PDT
accounts.youtube.com resolves through a CNAME to google.com, so the CNAME cloaking check caps the expiry of __Secure-1PSIDTS and __Secure-3PSIDTS on youtube.com. Once the capped cookie expires, the server deletes the YouTube session cookies and the user is signed out of YouTube while the Google session stays intact.
Attachments
Add attachment proposed patch, testcase, etc.
Radar WebKit Bug Importer
Comment 1 2026-10-27 12:04:24 PDT
<rdar://problem/191131755>
Ian Gower
Comment 2 2026-10-27 12:07:44 PDT
Pull request: https://github.com/WebKit/WebKit/pull/78492
EWS
Comment 3 2026-10-29 13:12:02 PDT
Committed 325161@main (a7d3aefbad17): <https://commits.webkit.org/325161@main> Reviewed commits have been landed. Closing PR #78492 and removing active labels.
Note You need to log in before you can comment on or make changes to this bug.