Cookies are referenced by array indices instead of names, leading to incorrect handling and console errors

Created on 18 February 2025, about 2 months ago
Updated 27 February 2025, about 1 month ago

Problem/Motivation

When using the module and accessing the site in Firefox with the network.cookie.sameSite.laxByDefault configuration set to true, the following error message appears repeatedly in the browser console:
Cookie “0” has “SameSite” policy set to “Lax” because it is missing a “SameSite” attribute, and “SameSite=Lax” is the default value for this attribute.
The same message is shown for cookies "1" and "2", and the messages are logged every 5 seconds. However, these cookie names ("0", "1", "2") do not exist.

The module sets three valid cookies: cookie-agreed-categories, cookie-agreed-version, cookie-agreed. These cookies are set with SameSite=Strict. The issue seems to arise from a Javascript bug.

In version 1.25, the function used to retrieve cookies changed:

  • Previously, the cookies.get() function returned an object.
  • The new getCookie() function returns an array.

See https://git.drupalcode.org/project/eu-cookie-compliance/-/commit/898b662...

This behavior explains the incorrect cookie names "0", "1", "2": they are array indices instead of actual cookie names.

While the problem is evident in Firefox when network.cookie.sameSite.laxByDefault is set to true, the underlying issue affects all browsers. For users of other browsers or those not enabling this Firefox configuration, the issue may not produce visible console errors but still results in incorrect cookie handling.

Steps to reproduce

  1. Install and enable version 1.25 of the EU Cookie Compliance module
  2. In Firefox, set network.cookie.sameSite.laxByDefault to true in about:config.
  3. Load the site with the console opened.
  4. Observe the repetitive error messages regarding cookies named "0", "1", "2".

Proposed resolution

The Javascript function responsible for reading and deleting cookies must correctly handle the array output from getCookie(). Specifically:

  1. Update the code to properly iterate through the array returned by getCookie().
  2. Ensure cookie deletion logic is based on valid cookie names, not array indices.

Remaining tasks

User interface changes

API changes

Data model changes

🐛 Bug report
Status

Active

Version

1.0

Component

Code

Created by

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

Production build 0.71.5 2024