1161646 - Honor the "From Visited" third-party cookie blocking pref in prerendering

Status: NEW

(Core :: DOM: Core & HTML, defect, P5)

Description

[(no longer active)]

We should make sure to not consider prerendered loads as visiting a domain for the first time as far as the "From visited" more of third-party cookie blocking is concerned.  Without this, a malicious website would be able to prerender eviltracker.com without the user's knowledge, mark eviltracker.com's cookies as coming from an origin which we have visited from top-level navigation before, and enable iframes to eviltracker.com to start tracking users when embedded in third-party websites.

Comment 1

[Tanvi Vyas[:tanvi]]

The implementation of third-party cookie blocking from visited is in bug https://bugzilla.mozilla.org/show_bug.cgi?id=730101.

Also note, some users might disable third party cookies altogether.  Not sure yet how we should deal with that case.  The prerendered cookies ideally shouldn't get set until the user actually navigates to that page.  But from talking to Ehsan, it sounds like that would be really tricky to implement.  Perhaps not marking them first party would be enough to satisfy both options (from visited and blocked)?  This would need more investigation.

Comment 2

[Tanvi Vyas[:tanvi]]

(In reply to Tanvi Vyas [:tanvi] from comment #1)
> The implementation of third-party cookie blocking from visited is in bug
> https://bugzilla.mozilla.org/show_bug.cgi?id=730101.
> 
Sorry, I linked the wrong bug.  The right one is https://bugzilla.mozilla.org/show_bug.cgi?id=818340

Comment 3

[Tanvi Vyas[:tanvi]]

Looks like there are some third party channel flags that help determine how to handle cookies on a given channel:
http://mxr.mozilla.org/mozilla-central/source/dom/base/ThirdPartyUtil.cpp#180
http://mxr.mozilla.org/mozilla-central/source/netwerk/protocol/http/nsIHttpChannelInternal.idl#102
http://mxr.mozilla.org/mozilla-central/source/netwerk/protocol/http/HttpBaseChannel.cpp#1603
http://mxr.mozilla.org/mozilla-central/source/extensions/cookie/nsCookiePermission.cpp#213

Comment 4

[Firefox Bug Husbandry Bot]

https://bugzilla.mozilla.org/show_bug.cgi?id=1472046

Move all DOM bugs that haven't been updated in more than 3 years and has no one currently assigned to P5.

If you have questions, please contact :mdaly.