129819 - QuickLaunch won't release session cookies

Status: VERIFIED FIXED

(Core Graveyard :: QuickLaunch (AKA turbo mode), defect)

Description

[fmouse-mozilla]

A cookie set without an "expires" attribute should remain in memory only and be
expunged when all open browser sessions are closed.  QuickLaunch interferes with
this.  If all browser windows are closed, apparently QuickLaunch retains the
cookie in memory so that subsequent browser sessions recall this cookie as if it
were a persistent cookie on disk.  This creates a major problem with session
cookies since a session can't be truly closed without killing QuickLaunch.  

From Netscape's Cookie Spec, "expires is an optional attribute. If not
specified, the cookie will expire when the user's session ends."

Comment 1

[Matthias Versen [:Matti]]

Build ID ?

(see bug 86067)

Comment 2

[Matthias Versen [:Matti]]

*** Bug 134619 has been marked as a duplicate of this bug. ***

Comment 3

[Matthias Versen [:Matti]]

*** Bug 125568 has been marked as a duplicate of this bug. ***

Comment 4

[Matthias Versen [:Matti]]

confirming and CC [e-mail]

Comment 5

[Bill Law]

Nominating and re-assigning to Steve.

Comment 6

[Samir Gehani]

Does this cause privacy violations where the second distinct user of the browser
is able to get at the first user's cookies or the value of the first user's
session cookies in an implicit fashion?

Comment 7

[http://tinymailto.com/oliversl]

The cookie should be delete when the browser that use that cookie is closed.
If you have aditional browsers, but in direffent sites and you close the
browser that use the cookie, the cookis should also be deleted and don't
wait until all browser are closed.
This is how it works in IE6, I don't if it is the correct way or
just a "feature" of IE, but it works nice.

Comment 8

[fmouse-mozilla]

Session cookies persist for the duration of a browser instance and are often
used for authenticated logins.  If one closes all running browser instances one
has a reasonable expectation that in-memory session cookies will go away,
however if QuickLaunch is running they don't.  If I were to walk away from my
computer after closing down a browser session on an authenticated site (as well
as all other visible browser instances), someone else could come to my computer,
open up a new browser window and use my still valid session cookies to get
immediate access to the authenticated site without knowing my password.  It's a
major security problem!

Comment 9

[Samir Gehani]

Nav triage team: nsbeta1+/adt2

Comment 10

[Stephen P. Morse]

Attachment: release session cookies at quicklaunch exit

Comment 11

[Samir Gehani]

Comment on attachment 77945 [details] [diff] [review]
release session cookies at quicklaunch exit

r=sgehani

Comment 12

[Darin Fisher]

Comment on attachment 77945 [details] [diff] [review]
release session cookies at quicklaunch exit

sr=darin

Comment 13

[scottputterman]

Adding since we were asked for approval.

Comment 14

[Jaime Rodriguez, Jr.]

adt1.0.0+ (on ADT's behalf) for approval to checkin to 1.0. Pls check this in today.

Comment 15

[Randell Jesup [:jesup] (needinfo me)]

Comment on attachment 77945 [details] [diff] [review]
release session cookies at quicklaunch exit

a=[e-mail]

Comment 16

[Stephen P. Morse]

Fix checked in

Comment 17

[Grace Bush]

verified on trunk 2002051708