1237777 - Third-party cookies set while Tracking Protection is off should not be preserved when it is back on

Status: REOPENED

(Toolkit :: Safe Browsing, defect, P5)

Description

[Don Marti]

(1) user turns off tracking protection for site A

(2) user uses the web normally with tracking protection on

(3) user later visits site B and turns off tracking protection there, too.

Somehow we need to clean up any cookies (or other state) that got set on A before third parties can see them while the user is on B.

Comment 1

[Don Marti]

One possible approach:

when turning off tracking protection: make a list of all sites that have stored state (cookies + other stuff)

when turning tracking protection back on:

 (1) list all sites that have stored state
 (2) skip the sites that were already listed when the user turned tracking protection off
 (3) check the remaining sites (hosts and URL paths) against the tracking protection list

Or keep track of cookies as having been accepted in an unprotected mode, and on which site, and clean them up on leaving that site.

Comment 2

[BMO Automation]

Per policy at https://wiki.mozilla.org/Bug_Triage/Projects/Bug_Handling/Bug_Husbandry#Inactive_Bugs. If this bug is not an enhancement request or a bug not present in a supported release of Firefox, then it may be reopened.

Comment 3

[Mark Banner (:standard8)]

Dropping mentors from this bug as there's not a clear description of what needs doing (possible isn't definite) / no pointers to code / no language information.