~/talk

Cookie Infrastructure at Meta

Talkat PEPR '23 · 2023-09-11..09-12· [web-platform, security]

speaker

name:Katriel Cohn-Gordon

links:none on file

resources

video:https://youtu.be/5_MuxLPhAKo

slides:none on file

summary

Meta enforces cookie behavior with a central cookie schema and a mandatory developer API that only allows reads/writes by inum identifiers so code can’t quietly set cookies, returns null for disallowed optional cookies, and lists TTLs for a one‑place 400‑day rollout. Third‑party control uses Content‑Security‑Policy headers served per request to block embeds when users decline, plus an internal mapping of first‑party domains (eg. fbcdn.net) and router changes that force full page reloads so CSP updates take effect. inum IDs provide an auditable inventory.

AI-written summary · about

chapters (5)

related talks