Blocking all first-party cookies is generally going to cause problems. Some sites, like ours, will have required cookies. This isn’t new as we’ve been using the same technology to restrict some endpoints like export map for years. There are alternative measures (JWTs, etc) but those can, if anything, transmit more information between same-site hosts. Some browsers can isolate sites so their cookies don’t persist beyond a session or don’t go to other sites. Those means should work fine.
I’ll be putting verification between OSM sites on the agenda for the next meeting but until then blocking cookies essential for site functionality will break site functionality.
file:// URLs is something we’ll need to discuss as a browser visiting such a site will, by default, not be in compliance with the tile usage policy.