How to Audit Partitioned Cookies (CHIPS) and Storage Partitioning in Google Chrome DevTools

The phase-out of traditional unpartitioned third-party tracking cookies across modern web browsers has fundamentally transformed privacy standards and cross-site architecture. Historically, when an embedded widget—such as a customer support chat interface, payment gateway iframe, or mapping module—set a cookie, that cookie was attached to every subsequent HTTP request originating from any top-level domain embedding that service. To preserve essential embedded functionality without enabling cross-site tracking across the wider web, Google Chrome introduced CHIPS (Cookies Having Independent Partitioned State). By assigning the Partitioned attribute, developers restrict cookie access strictly to the top-level site where the embedded resource was loaded. Understanding how to inspect, test, and audit partitioned cookies within Google Chrome DevTools ensures web applications maintain operational integrity under modern browser privacy controls.

Understanding the CHIPS Specification and Storage Partitioning

Under standard cookie semantics, a cookie’s partition key consists solely of the domain that issued it. For example, a third-party tracking pixel hosted at analytics.example reads the same cookie identifier whether the user visits store.alpha.com or blog.beta.com, facilitating cross-site browsing profiling.

The CHIPS specification introduces double-keyed cookie storage. When a server issues a cookie with the Partitioned attribute along with Secure and SameSite=None, Google Chrome isolates the cookie within a dual-key partition: the primary key is the top-level site (the scheme and eTLD+1 in the browser address bar, such as https://alpha.com), and the secondary key is the cookie domain (e.g. https://chat-widget.example). If the user subsequently navigates to https://beta.com containing the identical chat widget, the widget cannot access the cookie created under alpha.com. This ensures privacy isolation while preventing user session dropouts within embedded workflows.

Inspecting Partitioned Cookies in the DevTools Application Panel

Google Chrome DevTools includes dedicated visual indicators to verify whether your embedded iframes and third-party API dependencies set the Partitioned directive correctly.

1. Launch Google Chrome and navigate to the web page hosting your embedded third-party iframe or web service.
2. Open Chrome DevTools by pressing F12 or Ctrl + Shift + I (Windows/Linux) / Cmd + Option + I (macOS).
3. Select the Application panel located in the top navigation bar.
4. In the left-hand navigation sidebar, expand the Storage tree, then expand the Cookies node.
5. Select the third-party cookie origin you wish to audit.
6. Inspect the main cookie table in the right-hand panel. Locate the Partition Key column.
7. If the cookie has been successfully partitioned via CHIPS, the Partition Key column displays the top-level site URL (e.g. https://example.com). Furthermore, the Partitioned checkbox column will be checked. If these columns are empty, the cookie was rejected by the browser or issued under legacy unpartitioned rules.

Auditing Set-Cookie Headers and Browser Exclusion Reasons

When an embedded server attempts to issue a partitioned cookie with incorrect attributes, Chrome silently discards the partition or blocks the cookie entirely. You can diagnose these handshake failures directly in the Network inspector.

1. In DevTools, switch to the Network panel and refresh the webpage.
2. Select the specific network request responsible for setting the cookie (such as an iframe resource, API handshake, or authentication POST request).
3. In the request details pane, select the Cookies tab.
4. Examine the Response Cookies section. Chrome highlights cookies that failed compliance checks with warning badges.
5. Hover over any yellow warning icon next to a Set-Cookie header to reveal the diagnostic tooltip. Typical compliance failures include:
   • Missing Secure Attribute: All partitioned cookies must include the Secure flag; plain HTTP connections are rejected.
   • Missing SameSite=None: Partitioned cookies require SameSite=None to permit transmission across third-party embedding contexts.
   • Missing Path Attribute: Ensure the Path=/ directive is explicitly specified to avoid restricted scope boundaries.

Simulating Storage Partitioning in Local Development Environments

Testing CHIPS on localhost requires specific configuration because top-level site partitioning rules rely on registrable domain suffixes (eTLD+1). Testing multi-origin iframes on a single development workstation can be simulated using local host mapping and Chrome runtime flags.

1. Edit your workstation’s hosts file (located at C:\Windows\System32\drivers\etc\hosts on Windows or /etc/hosts on macOS/Linux) to define two distinct virtual domains:

   127.0.0.1 site-alpha.local
   127.0.0.1 widget-provider.local

2. Generate self-signed SSL certificates for both domains using OpenSSL or mkcert to satisfy the mandatory Secure HTTPS requirement.
3. Launch Chrome from the command line with experimental privacy sandbox flags enabled if testing upcoming storage boundary policies:

   chrome.exe --enable-features=PartitionedCookies,ThirdPartyStoragePartitioning

4. Embed widget-provider.local inside an iframe on site-alpha.local, trigger a cookie creation routine, and verify that the partition key resolves to https://site-alpha.local within the DevTools Application panel.

Verifying Privacy Sandbox Compliance via the Issues Panel

To ensure automated detection of deprecated cookie patterns across an entire enterprise web property, consult the Chrome DevTools Issues drawer.

1. In DevTools, press Esc to open the bottom console drawer.
2. Select the Issues tab.
3. Expand the Third-party cookie phaseout alert category.
4. Chrome enumerates every resource, script, and domain requesting unpartitioned cookie access. Click any reported issue to reveal the exact source line in JavaScript and direct remediation advice on transitioning the resource to CHIPS or the Storage Access API.

Auditing partitioned cookies in Chrome DevTools ensures web applications remain fully functional, compliant with global privacy mandates, and resilient against third-party cookie deprecation.