1364782 - "browser.cookies.remove" method does not remove all cookies

Status: RESOLVED DUPLICATE of bug 1362834

(WebExtensions :: General, defect, P3)

Description

[AuroraBorealis]

User Agent: Mozilla/5.0 (Windows NT 10.0; rv:53.0) Gecko/20100101 Firefox/53.0
Build ID: 20170504105526

Steps to reproduce:

 Some internet pages (google.com or ups.com) provide "semi - permanent" cookies that cant be removed by this method (google => url: ".google.com" name:"NID"). This behaviour could be also a BUG in the cookie collection class. Only if the privacy settings in firefox are set to "custom settings" and the option "accept only 3rd party cookies from visited sites" is enabled, all cookies from the collection can be removed via "browser.cookies.remove".


Actual results:

The cookies are not removed but they are still listed. The internet page that stored the cookie create a new cookie of the same type next time this site is visited.


Expected results:

the browser.cookies class of the API has to be extended by a method "removeAll" that removes all cookies : 3rd party cookies of visited as well as cookies for not - visited internet pages (perhaps: google => google.de visited but 4 cookies are stored for 2 x google.com and 2 x google.de)

Comment 1

[:shell escalante]

Hi Dan,

Who is the person who we should talk to about the overall desired cookie handling behavior / pref configuration combinations.

we have another similar cookie handling question in bug 1362834.  
another webextension+ bug related to this cookies pref... bug 1322113.

before we start changing - want to discuss desired interactions.

Comment 2

[Matthias Simon]

As mentioned in bug 1362834, the google cookie that cannot be removed with cookies.remove() comes from a request to safebrowsing.google.com, which happens internally and comes not from a site a user visits.

Comment 3

[Bob Silverberg [:bsilverberg]]

Thanks for the update Matthias. I'm still not sure what the ramifications of that are. Is that expected behaviour, that a WebExtension would not be able to remove that cookie?

Comment 4

[Daniel Veditz [:dveditz]]

If this is just about not being able to remove the Google safebrowsing cookie then it's a dupe of bug 1362834, and I don't think we want to change the behavior. But the first words of the description here were "Some internet pages (google.com or ups.com) provide..." and something about the "accept only from visited" option. Bug 1362834 wouldn't have anything to do with UPS.com, but I can't tell from the description what the problem with ups.com is supposed to be. The problem statement in this bug is unclear, needs "steps to reproduce" that are actual "steps".

(In reply to :shell escalante from comment #1)
> Who is the person who we should talk to about the overall desired cookie
> handling behavior / pref configuration combinations.

Schedule something with me and Paul Theriault -- probably should be a formal "PI Request" to get it onto our schedules. Unfortunately Tanvi is out for a few months, but maybe we should rope in Jonathan Kingston, too.

Comment 5

[AuroraBorealis]

Hi,

> The problem statement in this bug is unclear...

Problem: 

The function call "browser.cookies.remove" acts different from the feature "clear all cookies" available from "Extra -> Settings -> Privacy -> dialog cookies". The end user / customer expects the same results for both ways.

Steps to reproduce for both ways:

A) 

1. Enable the option "always create a chronik in firefox" in "Settings -> Data privacy".
2. Navigate to "google.com" or "ups.com".
3. Open the dialog from "Settings -> Data privacy -> erase single cookie".
4. Press the button "Erase all cookies".

Result: All cookies have been erased

B)

1. Enable the option "always create a chronik in firefox" in "Settings -> Data privacy".
2. Navigate to "google.com" or "ups.com".
3. call in your addon a function which erases all the cookies via "browser.cookies.remove" function.

Result: NOT all cookies have been erased.

Proposal / Feature request:

Add to the class browser.cookies a method which behaves like the button "Erase all cookies" in the "cookies" dialog from "Settings -> Data privacy".


Best regards

Dipl.-Ing. M. Türschmann

Comment 6

[:shell escalante]

thanks Dan for details in Comment 4.

Hi Andy,  Is there anyone besides yourself from the webextension side to you want me to include for the cookie discussion when setting that up?

Comment 7

[Bob Silverberg [:bsilverberg]]

Please include me in the meeting invite, Shell.

Comment 8

[Andy McKay]

Shane, Bob and myself please.

Comment 9

[Bob Silverberg [:bsilverberg]]

This is a duplicate of bug 1362834