1046430 - Revert aurora/nightly default cookie behavior to match release/beta

Status: RESOLVED FIXED

(Core :: Networking: Cookies, defect)

Description

[[:nmalkin]]

User agent:

This bug appears in the latest Nightly (Firefox 34). It behaves correctly in the current stable version (Firefox 31).


Steps to reproduce:

1. Start with a page that sets a cookie and redirects (HTTP 302) in the same request
2. Load that page in an iframe
3. Make sure the page that serves the iframe is on a different host/origin from the page in the iframe


Expected behavior:

- The cookie is set


Actual behavior:

- The cookie is *not* set


Test case: https://gist.github.com/nmalkin/cb50a41698ed99f84a6f
(clone this gist to try it yourself)

This defines a simple server that sets a cookie before redirecting the page to a new destination.
The destination checks to see if the cookie was set.

(To run the server, install Flask [pip install -r requirements.txt] and run server.py)

To see the bug in action: open iframe.html in your browser, as a local file. 
As you'll see, the iframe is redirected to the new page, but the cookie is not set.

If you now open the root of the server, which serves the exact same content, you'll see that, this time, the cookie is set successfully.

(Note that the page with the iframe doesn't have to be served over file://; the bug also appears if it's served over http or https, as long as the host/origin is different from that of the iframe.)


Extra:

- I reproduced this on a fresh profile, with no extensions.
- I cannot reproduce in Firefox 31, the current stable version.

Comment 1

[[:mmc] Monica Chew (no longer reading bugmail)]

I suspect this is because Nightly has different default cookie permissions than stable, regardless of version.

Can you go to Preferences > Privacy > Use Custom Settings for History and make sure "Accept third party cookies" is set to Always, and try to reproduce?

Comment 2

[[:nmalkin]]

You're right: enabling "Accept third party cookies" in Nightly fixes the issue.

Comment 3

[[:mmc] Monica Chew (no longer reading bugmail)]

Thanks for confirming, nmalkin. I'm planning to revert the default in Nightly to "accept all cookies" to avoid developer confusion, but it is taking a while to coordinate with non-engineering teams.

Comment 4

[[:mmc] Monica Chew (no longer reading bugmail)]

On second thought, leaving this open.

Comment 5

[[:mmc] Monica Chew (no longer reading bugmail)]

Attachment: Make cookie behavior the same on beta/release as on aurora/nightly

Comment 6

[[:mmc] Monica Chew (no longer reading bugmail)]

https://tbpl.mozilla.org/?tree=Try&rev=121923c67f2f

Comment 7

[[:mmc] Monica Chew (no longer reading bugmail)]

Attachment: Make cookie behavior the same on beta/release as on aurora/nightly

Comment 8

[[:mmc] Monica Chew (no longer reading bugmail)]

Comment on attachment 8500780 [details] [diff] [review]
Make cookie behavior the same on beta/release as on aurora/nightly

Review of attachment 8500780 [details] [diff] [review]:
-----------------------------------------------------------------

This pref change never rode the trains and never will in its current state. We are working on something better in https://bugzilla.mozilla.org/show_bug.cgi?id=1029886 that solves a lot of problems with this approach. This patch also fixes bug 1066613.

Comment 9

[Josh Matthews [:jdm]]

Comment on attachment 8500780 [details] [diff] [review]
Make cookie behavior the same on beta/release as on aurora/nightly

Review of attachment 8500780 [details] [diff] [review]:
-----------------------------------------------------------------

::: testing/web-platform/tests/html/dom/documents/resource-metadata-management/document-cookie.html
@@ +15,5 @@
>    var doc = document.implementation.createHTMLDocument("doc");
>    assert_equals(doc.cookie, "");
>    doc.cookie = "test=foobar";
> +  assert_equals(doc.cookie, "test=foobar");
> +}, "Setting cookie for document should work.");

We can't modify these tests. We need to add an expected failure to an ini file in http://mxr.mozilla.org/mozilla-central/source/testing/web-platform/meta/html/dom/documents/resource-metadata-management/.

Comment 10

[[:mmc] Monica Chew (no longer reading bugmail)]

https://tbpl.mozilla.org/?tree=Try&rev=4da819513280

Comment 11

[[:mmc] Monica Chew (no longer reading bugmail)]

Attachment: Make cookie behavior the same on beta/release as on aurora/nightly (

Comment 12

[[:mmc] Monica Chew (no longer reading bugmail)]

Comment on attachment 8501202 [details] [diff] [review]
Make cookie behavior the same on beta/release as on aurora/nightly (

Address jdm's feedback, waiting on try before checking in.

Comment 13

[Doug Turner (:dougt)]

I'd like to see a comms plan before we land this please.

Comment 14

[[:mmc] Monica Chew (no longer reading bugmail)]

I'll add you to the thread with Erica.

Comment 15

[[:mmc] Monica Chew (no longer reading bugmail)]

[Tracking Requested - why for this release]: This has to make it in before 35 hits beta, otherwise we break the tree because of https://bugzilla.mozilla.org/show_bug.cgi?id=1066613.

Comment 16

[[:mmc] Monica Chew (no longer reading bugmail)]

https://tbpl.mozilla.org/?tree=Try&rev=9e07924ea437

Comment 17

[[:mmc] Monica Chew (no longer reading bugmail)]

https://tbpl.mozilla.org/?tree=Try&rev=7a059b559549

Comment 18

[[:mmc] Monica Chew (no longer reading bugmail)]

https://tbpl.mozilla.org/?tree=Try&rev=f2cc3c8d2342

Comment 19

[[:mmc] Monica Chew (no longer reading bugmail)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/53027edc3bde

Comment 20

[[:mmc] Monica Chew (no longer reading bugmail)]

Attachment: Make cookie behavior the same on beta/release as on aurora/nightly (

Comment 21

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/53027edc3bde

Comment 22

[[:mmc] Monica Chew (no longer reading bugmail)]

Comment on attachment 8521887 [details] [diff] [review]
Make cookie behavior the same on beta/release as on aurora/nightly (

Approval Request Comment
[Feature/regressing bug #]: 818340 (the part of that bug that set the default cookie preference)
[User impact if declined]: We need an alternative solution to bug 1066613
[Describe test coverage new/current, TBPL]: m-c
[Risks and why]: Pretty low risk. This pref change affects only Nightly and Aurora, the original default pref change from bug 818340 never progressed to beta.
[String/UUID change made/needed]: none.

Comment 23

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/8e9cc4b2f923