Handle cross-site and partitioned cookies

Embedded content creates a second context: who set the cookie, and which top-level site contains it.

SameSite=Lax or Strict limits cross-site delivery. SameSite=None permits cross-site use and requires Secure. A Partitioned cookie adds the top-level site to its storage key, so the same embedded service receives a separate cookie jar on different sites.

Set-Cookie: __Host-widget=compact; Path=/; Secure; SameSite=None; Partitioned

Partitioning supports an embedded feature that needs per-site state without one identifier following the user across every host site. It does not turn a cookie into shared first-party storage.

Browser privacy policies and storage access rules keep changing. Design embeds to work without cross-site cookies where possible, and test the supported browser matrix with blocking enabled.

Draw the cookie keys for one widget embedded on two unrelated top-level sites. Explain what the widget server receives with an unpartitioned cookie, a partitioned cookie, and no cross-site cookie access.