1309800 - The firstPartyDomain should be blogger.com, not google.com (Enter "blogger.com" in Url bar)

Status: RESOLVED INVALID

(Core :: DOM: Security, defect, P3)

Description

[Cynthia Tang [:cynthiatang]]

This issue can be reproduced in Non-e10s and e10s

Default search engine: Google

Step:
1. Clear all History and Cookies
1. Launch Firefox browser
2. Go to blogger.com
3. Click on the Add-ons “Cookies Manager +” to view the originAttributes

Actual result:
 - Video: https://youtu.be/V9fVhmt56Dw 
 - There are 3 cookies. 
   1. Domains:          accounts.google.com
      firstPartyDomain: google.com
   2. Domains:          .blogger.com
      firstPartyDomain: blogger.com
   3. Domains:          .blogger.com
      firstPartyDomain: blogger.com

Expected result:
 - The firstPartyDomain should be "blogger.com", not "accounts.google.com"

Firefox version: 52.0a1 (2016-10-11) (64-bit)

Comment 1

[Ethan Tseng [:ethan]]

Kamil, please help to investigate this bug, thanks!

Comment 2

[Daniel Veditz [:dveditz]]

This could be correct behavior since it's a top level redirect. Logically in this case (A->B->A) you could argue it's all in the context of A; other redirect cases would be more problematic such as search result links that redirect through the search provider before landing on the final target. Certainly don't want all my search results to live in the bucket of the search provider. The browser can't tell we're in an "auth loop" when it gets the first redirect. We could (or Tor could) whitelist a bunch of known auth providers like google and facebook and maybe that would be good enough for them?

Comment 3

[Jonathan Hao (inactive) [:jhao]]

Attachment: Screen Shot.png

We can clearly see in dev tools that this page has been redirected to account.google.com and back again.

Comment 4

[Jonathan Hao (inactive) [:jhao]]

I agree with Dan that this is correct behavior.

Comment 5

[Ethan Tseng [:ethan]]

(In reply to Jonathan Hao [:jhao] from comment #3)
> Created attachment 8813553 [details]
> Screen Shot.png
> 
> We can clearly see in dev tools that this page has been redirected to
> account.google.com and back again.

Jonathan, thanks for confirming this!

Comment 6

[Arthur Edelstein [:arthur]]

(In reply to Daniel Veditz [:dveditz] from comment #2)
> This could be correct behavior since it's a top level redirect. Logically in
> this case (A->B->A) you could argue it's all in the context of A; other
> redirect cases would be more problematic such as search result links that
> redirect through the search provider before landing on the final target.
> Certainly don't want all my search results to live in the bucket of the
> search provider. [...]

On the other hand, all your search results are known to the search provider anyhow. Say you have search provider G, and Gr is another domain that redirects to the search result, R. (G -> Gr -> R.) I think assigning Gr the firstPartyDomain of G is probably OK. See also bug 1319839 comment 5.

(Off-topic, but we could include a nonce in the OriginAttributes for use with things like search providers. So each time we connect to G with a new search, we get a new bucket: G[1], G[2], G[3]. The 302 at Gr would be assigned a new bucket each time as well.)