452575 - file:// & cookies: ask always doesn't work properly

Status: RESOLVED DUPLICATE of bug 440973

(Firefox :: File Handling, defect)

Description

[Tom Link]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.1) Gecko/2008070208 Firefox/3.0.1
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.1) Gecko/2008070208 Firefox/3.0.1

I have set my cookie preferences to "ask always". When I save a page as file that want to set a cookie when javascript is enabled, the usual dialog pops up: file:// wants to set|modify a cookie.

There are IMHO two problems with this:

1. My preference (use always for this host) isn't saved, which is to some degree sensible since there is no host attached to a file url but on the other hand this can result in an endless loop when trying to deny setting a cookie.

2. IMHO local files should never be allowed to set a cookie. What for?


Reproducible: Always

Steps to Reproduce:
1. Save page that wants to set a cookie and doesn't accept a no as answer
2. Open that page
3. Try to deny setting a cookie
Actual Results:  
denial ad infinitum

Expected Results:  
Local files shouldn't be allowed to set cookies

Comment 1

[Jesper Hansen]

For number 2:
Developers who are testing javascript locally that sets and reads of some cookies. (Javascript can be used to set/get cookies)

Comment 2

[Matthew Knowlton]

#2: For 127.0.0.1 developmental testing possibly, and for javascript.

Comment 3

[Matthew Knowlton]

P.S. (In reply to comment #2)
> #2: For 127.0.0.1 developmental testing possibly, and for javascript.
> Possibly some other clientside languages as well like Java etc...

Comment 4

[Tom Link]

I'd assume that people test there stuff on a local web server and not by opening the file as such.

Anyway, that's not the point. The problem is that the user preference apparently doesn't get saved.

Comment 5

[John Rouillard]

Applications such as tiddlywiki and other wiki on a stick use cookies
with a file:// based url.

See also: https://bugzilla.mozilla.org/show_bug.cgi?id=440973

Comment 6

[Sidney Markowitz]

I have run into the problem a number of times in web based documentation that is available for downloading to my local disk. They often are written using common web development tools and contain javascript and use cookies. Whether or not you think that a web developer should be able to write such a document so it doesn't use cookies, they don't do that. That means that in a number of documents I have downloaded, every click results in a dialog asking me what to do with the cookie unless I change my global preferences to never ask, or figure out how to edit the files by hand to not use cookies.

Comment 7

[Sidney Markowitz]

BTW, this should be changed from Windows to all platforms. It is inherent in the fact that the cookie exceptions are stored by host after stripping off the protocol, and file:// URLs all start with file:/// and so have no host name.

Comment 8

[Sidney Markowitz]

The specific use case for a local file setting cookies that I have seen: One that has javascript using a session cookie to save state so that you can expand and collapse paragraphs by clicking on links in an outline view. Note that the arguments that a local file should not set cookies are true only for permanent cookies. Part of the problem is that Firefox does not provide a UI for setting "ask every time" just for permanent cookies and not for session cookies.

This bug appears to be a duplicate of bug #440973