Problem

  • The jquery.cookie library was temporarily absorbed by jQuery UI, but has been removed from the latest jQuery UI now.

Details

  1. In reviewing/fixing our library declarations for #1996238: Replace hook_library_info() by *.libraries.yml file, I noticed that jquery.cookie was/is supplied as part of jQuery UI 1.10.2.

    So I hopped on to #jquery in IRC to get some info, insights, and opinions...

  2. https://github.com/jquery/jquery-ui/tree/master/external does not contain it anymore.
  3. This commit removed it via #7162 → META: #7144
  4. jQuery UI's $.cookie() plugin had a different API than the original jQuery.cookie() library.
  5. It might be safer to bet on the original jquery.cookie library. But then again, the code of the jQuery UI plugin is much shorter and simplified.
  6. OTOH, looking at what the jQuery UI plugin does, the native document.cookie API might be sufficient to begin with?

Proposed solution A

  1. Restore the jquery.cookie plugin from jQuery UI's history and include it as a fork in Drupal. (No API changes)

Proposed solution B

  1. Restore the original jquery.cookie library and revert all code to the original API. (future-proof?)

Proposed solution C

  1. Drop $.cookie() altogether and require all code to use the native document.cookie API instead.
Support from Acquia helps fund testing for Drupal Acquia logo

Comments

scott.gonzalez’s picture

A few clarifications:

The cookie plugin was never part of jQuery UI. It was included as an external purely for the purpose of creating a demo to show how to use the cookie plugin with the jQuery UI tabs plugin.

The cookie plugin was copied into the external directory as is. jQuery UI never modifies external code, so it's impossible for the API to have been different.

Any file size difference (and API difference for that matter) is due to the fact that you're comparing the current version of the plugin to a version from 2010.

nod_’s picture

I'd go with:

Proposed solution D

  1. Drop $.cookie() altogether and stop using cookies to store anon username and mail for comments and contact form. localStorage does that.

The only change would be that the information is saved regardless of the form being successfully submitted or not (we only save the info on form submit but if there is a validation error, the infos would still be saved).

sun’s picture

Thanks a ton for the helpful clarifications, Scott! :)

Looks like someone of us misinterpreted the mere existence of the file in the jQuery UI package as something that can be relied on ;-)

Thanks to that pointer, I checked past releases and the exact version in HEAD appears to be v1.0.

catch’s picture

Category: Bug report » Task

There's no functional bug here so re-classifying. This will need a library rename (or completely killing it) so agreed on critical though.

maartendeblock’s picture

+1 for solution D.

nod_’s picture

Or even proposition E: remove the whole user info thing and let browsers handle it. They all remember usernames in forms now. Unless you disabled the functionality which means saving the infos in a cookie probably isn't what you'd want.

nod_’s picture

Status: Active » Needs review
FileSize
7.02 KB

patch for solution E

nod_’s picture

FileSize
7.84 KB

Missed a few spots

sun’s picture

While the goal of removing ballast is appreciated, to be honest, I think we need to provide an option for developers not-so-versed in JS to manage data stored on the client-side.

That doesn't necessarily have to be cookie-based, but as a web developer, I expect a web application framework to provide an API/facility that allows me to interface with client-side storage in a simple and easy way.

Also, the form autocomplete facility of browsers is very different to prepopulated form fields, because you typically have to use a built-in autocomplete facility in case varying values were submitted on similar forms (across the net, not restricted to a particular site).

The last submitted patch, 7: core-js-remove-cookie-2161217-7.patch, failed testing.

Status: Needs review » Needs work

The last submitted patch, 8: core-js-remove-cookie-2161217-8.patch, failed testing.

nicksanta’s picture

I think it is worth acknowledging that modern browsers all support window.localStorage, and that is a simple enough interface to store data on the client side.

Drupal 8 supports IE9+, and local storage was introduced in IE8.

I think a compromise between nod_ and sun's solutions is to replace all references to $.cookie() with localStorage, rather than remove the functionality all together.

sun’s picture

Bès’s picture

Assigned: Unassigned » Bès
sun’s picture

Note that one essential difference between localStorage and cookies is that cookie information is also available on the server-side (in PHP).

It is true that - aside from user authentication/sessions - we've replaced most usage of cookies with localStorage or alternative solutions.

But nevertheless, I wanted to point out that there can still be legit use-cases for using cookies when the identical data needs to be shared between the client-side and server-side (and avoiding an additional + async HTTP request to exchange the client-side data with the server-side).

Personally, I'd prefer to simply add the latest release of the jquery.cookie library for D8, so as to resolve this issue and get it off the table.

For D9, we can consider to re-open this discussion (in case library usage data proves that no one needs jquery.cookie anymore).

nod_’s picture

In theory I agree, we can ship the lib or something but what we use them for really doesn't need to be cookies.

sun’s picture

Status: Needs work » Needs review
FileSize
7.9 KB
  1. Moved jquery.cookie.js into own asset component. (official package name: jquery.cookie)
  2. Updated jquery.cookie to latest release v1.4.0.
Bès’s picture

**** Cross post message ****
I find an issue with the jquery-joyride library while creating a patch that replace cookie by localStorage for the auto fill.

We use the 2.0.3 version of jquery-joyride that rely on jquery.cookie.

Seems that the last version (2.1) can use localStorage as see here : https://github.com/zurb/joyride

This issue already talk about the joyride version : https://drupal.org/node/2027623
If joyride 2.1 works I propose to update to this version to allow the full removal of jquery.cookie.

BTW, i see that jquery.form.js also have jquery.cookie as a dependency in the core.libraries.yml but i can't find any reference of that on jquery.form's website or code.
****

Since we keep jquery.cookie, there is no issue with jquery-joyride and I hope I can soon propose a patch for the localStorage autofill feature.

Bès’s picture

FileSize
7.9 KB
sun’s picture

I'd recommend to strictly limit this issue to updating the library. Anything else should be handled in separate issues.

Bès’s picture

Assigned: Bès » Unassigned
ianthomas_uk’s picture

Issue tags: +revisit before beta

Moving revisit before beta tag from #1203526: jquery.cookie version update

sun’s picture

Issue tags: +Needs manual testing

We do not have automated JS tests, so the only remaining task here is to manually test whether e.g. the persistence of comment author information in the comment form still works.

penyaskito’s picture

Status: Needs review » Reviewed & tested by the community
  1. Launched a patched sandbox on Simplytest.me.
  2. Installed standard profile.
  3. Created an article.
  4. Add the "Post comments" and "Skip comment approval" permissions to anonymous.
  5. Open another browser session, post a comment as anonymous selecting "xxxx" as username.
  6. Checked that there is a cookie

The cookie:

 "[
{
    "domain": "sfa3b2f23c5a5028.s2.simplytest.me",
    "expirationDate": 1429046231.278518,
    "hostOnly": true,
    "httpOnly": false,
    "name": "Drupal.visitor.name",
    "path": "/",
    "secure": false,
    "session": false,
    "storeId": "1",
    "value": "xxxx",
    "id": 1
}
]

But...
form.js was not included in the form, so there is no completion. jquery.cookie.js was neither in the page.
We need to create bug reports for that if there aren't yet.

But as we only want to upgrade the library in this issue, I guess I can RTBC it.

catch’s picture

Status: Reviewed & tested by the community » Fixed

Committed/pushed to 8.x, thanks!

  • Commit c4b192d on 8.x by catch:
    Issue #2161217 by nod_, Bès: jQuery Cookie library is no longer included...
penyaskito’s picture

ianthomas_uk’s picture

Issue tags: -revisit before beta

Now this is fixed we don't need to pay any more special attention to this library before beta.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.