1166710 - Replace Cookie Prefs with Offline Storage Prefs

Status: RESOLVED WORKSFORME

(Firefox :: Settings UI, defect)

Description

[TGOS]

If a web page wants to store info permanently (e.g. for tracking), it has three options nowadays: Cookies, DOM Storage and IndexedDB. I can control cookie storage in the prefs, I can indirectly control DOM storage (as it respects cookie settings, but that is a "super hidden feature" documented exactly nowhere in the app), I cannot control IndexedDB storage at all other than to disable this feature in about:config. Meanwhile I seriously ask myself, why do I even bother about cookie storage in the first place if it is so easy to store the Cookie info with other APIs that bypass all user control?

The whole cookie pref is basically nonsense, as why would I allow a webpage to store cookies but not use DOM Storage? And why would I forbid it to use cookies but allow IndexedDB entries? A webpage that wants to track me at all coast will support all three APIs to place a tracking cookie and use whatever is available.

Death to the cookie prefs! Long live the offline storage pref!

Just make one pref for offline storage and make all the APIs respect it; done.

  [  ] Allow sites to store offline data (cookies, DOM storage, IndexedDB)
       Accept also from third-party sites [...]
       Keep until [...]

Allow all data to be seen (view may vary by type of course) and allow exceptions to be set (which also applies to all APIs).

Cookies are a dying concept, they are limited to HTTP (DOM storage and IndexedDB would also work if webpages are one day delivered by a different transport protocol that may not have a cookie header), they are ineffective (especially for big data, as they are sent with every request, wasting lots of bandwidth) and in ten years nobody might remember what a cookie was. An offline storage manager can manage all offline storage, even if another ten APIs are added to Firefox in the next years to come, the basic principle is always the same:

Either a site may use the API or it may not. And if it may use the API, either the data is kept around for as long as the site wants that (whether it expires automatically like cookies or manually like IndexedDB is a minor detail users don's care for) or just for the session. The user can decide.

Comment 1

[Johann Hofmann [:johannh]]

4 years later the cookie pref should control all kinds of storage, and the UI reflects that now.