1449799 - Limit Flash CTA permission to current session

Status: RESOLVED WONTFIX

(Core Graveyard :: Plug-ins, enhancement, P3)

Description

[Chris Peterson [:cpeterson]]

Our Plugin Roadmap [1] says: "In the second half of 2018, Firefox will no longer remember the Flash setting, and users will have to choose each session whether to activate Flash."

Users will need to click to allow Flash every session, but they should still be able to click "Never Allow" so we don't pester them with Flash CTA door hangers that they never want to allow.

Google plans [2] to make a similar change in Chrome 68 (July 2018). We should let Chrome ship first. The Firefox releases in 2018 H2 after Chrome 68 are Firefox 62-64, so we should aim to land this change in Nightly 62 (May).

[1] https://developer.mozilla.org/en-US/docs/Plugins/Roadmap
[2] https://sites.google.com/a/chromium.org/dev/flash-roadmap#TOC-Non-Persisted-HTML5-by-Default-Target:-Chrome-68---July-2018-

Comment 1

[Chris Peterson [:cpeterson]]

UX requirements from Bram:

1. Remove the Flash CTA door hanger's "Remember this decision" checkbox.

2. Replace the "Don't Allow" button with a drop-down menu with a separate "Don't Allow" and "Never Allow" menu items (like the "Save Password" door hanger).

3. Clicking outside the door hanger should not dismiss the door hanger.

4. Pressing ESC should be the equivalent of choosing "Don’t Allow" (then, inside the Info Center, the state is labelled "Blocked Temporarily"). Doing so will dismiss the door hanger.

Comment 2

[Chris Peterson [:cpeterson]]

We've decided to not make this change. Firefox currently resets a site's CTA permission every 90 days, after which Firefox will ask the user to CTA again for that site. The 90 day period is controlled by the "plugin.persistentPermissionAlways.intervalInDays" pref.

Comment 3

[Prakash Venkatesh]

Hi,

Just wanted to know if there is way that we can validate the 90 days permission revoke thing on the nightly build. 

Thanks,
Prakash

QA Manager 
Zynga Inc.

Comment 4

[Chris Peterson [:cpeterson]]

(In reply to Prakash Venkatesh from comment #3)
> Just wanted to know if there is way that we can validate the 90 days
> permission revoke thing on the nightly build. 

Felipe, is there a way to manually set when the CTA permission's 90 day counter starts or ends?

Prakash, you can use the about:config pref "plugin.persistentPermissionAlways.intervalInDays" to change 90 days to 1 day, but that doesn't make testing the persistent permission expiration much easier (because you still have to wait a day).

You can also change "plugin.sessionPermissionNow.intervalInMinutes" from 60 minutes to 1 minute to test the per-session permission expiration ("Allow Now" in Flash CTA door hanger without checking the "Remember my decision" door hanger's checkbox) during the current browser session.

Comment 5

[Chris Peterson [:cpeterson]]

Prakash, here is an easy way to simulate what happens when the persistent click-to-activate permission expires.

1. Open Firefox and run some Zynga Flash tests, allowing them click-to-activate permission and checking "Remember my decision".
2. Close all tabs running Flash.
3. Open "History" menu > "Clear Recent History" menu item > check the "Site Preferences" checkbox.
4. Quit and restart Firefox (just to be sure your browser session state is clean).

When Firefox restarts, the click-to-activate permissions will be expired. When you browse to Zynga Flash tests now, you will see the same user experience as your users when their persistent permissions expire after 90 days.

Comment 6

[Prakash Venkatesh]

Thanks for the reply Chris.

I was able to validate permission expiration thing successfully by changing  "plugin.persistentPermissionAlways.intervalInDays" key value to 1 from 90 days. After setting the value to 1 reauthorization flow for flash do trigger everyday.

But, i couldn't get the purpose "plugin.sessionPermissionNow.intervalInMinutes" key because after changing to 1 from default value of 60 i didn't notice any changes in the flow.

One last question on this , as per the current roadmap firefox has no plays to ask users to activate flash on every session. 

But, in near future if you guys decide to go with the changes will that require some code changes or will it be just a value change in the "plugin.persistentPermissionAlways.intervalInDays" key.

Comment 7

[Chris Peterson [:cpeterson]]

(In reply to Prakash Venkatesh from comment #6)
> But, i couldn't get the purpose
> "plugin.sessionPermissionNow.intervalInMinutes" key because after changing
> to 1 from default value of 60 i didn't notice any changes in the flow.

I haven't tested setting "plugin.sessionPermissionNow.intervalInMinutes" to 1, but I see that the Flash permission code does check that pref value. Maybe the session permission won't expire unless you close all your tabs with Flash content?

> One last question on this , as per the current roadmap firefox has no plays
> to ask users to activate flash on every session. 
> 
> But, in near future if you guys decide to go with the changes will that
> require some code changes or will it be just a value change in the
> "plugin.persistentPermissionAlways.intervalInDays" key.

We don't plan to expire permissions with every session. We removed it from our Plugin Roadmap [1]. But if we did implement it, we would need to do something more complicated (but more user friendly) than setting "plugin.persistentPermissionAlways.intervalInDays" value to 0 or 1. intervalInDays can expire permissions if you leave Firefox running for multiple days. We would need to allow permissions until the user quits Firefox, even if their browser session lasts multiple days.

Note that Chrome will expire permissions with every session in Chrome 69 (September release date) according to their Flash roadmap [2].

[1] https://developer.mozilla.org/en-US/docs/Plugins/Roadmap
[2] https://sites.google.com/a/chromium.org/dev/flash-roadmap#TOC-Non-Persisted-HTML5-by-Default-Target:-Chrome-69---September-2018-

Comment 8

[Prakash Venkatesh]

Thanks for the info :)

Comment 9

[Abdul Challawala]

Hi Chris,

With the earlier roadmap item:

"In the second half of 2018, Firefox will no longer remember the Flash setting, and users will have to choose each session whether to activate Flash." 

being removed from current Firefox Plugin roadmap. And given Firefox has a configuration flag ("plugin.persistentPermissionAlways.intervalInDays") which could force the above behavior. Can we expect Firefox to reduce the above configurable number and in a way, implement session based Flash activation? Or is there an alternate plan on deprecating Flash support which would come into effect this year or early 2019? Also is there a similar plan in place broken down by upcomping Firefox release versions?


Thanks,
Abdul Challawala

Software Engineer
Zynga Inc.

Comment 10

[Chris Peterson [:cpeterson]]

(In reply to Abdul Challawala from comment #9)
> being removed from current Firefox Plugin roadmap. And given Firefox has a
> configuration flag ("plugin.persistentPermissionAlways.intervalInDays")
> which could force the above behavior. Can we expect Firefox to reduce the
> above configurable number and in a way, implement session based Flash
> activation?

No. There is no plan to change the "plugin.persistentPermissionAlways.intervalInDays" value. It will stay at 90 days.

Note that Chrome 69 (expected to be released in September; currently in the Chrome Beta channel) will expire permissions with every session according to Google's Flash roadmap:

https://sites.google.com/a/chromium.org/dev/flash-roadmap#TOC-Non-Persisted-HTML5-by-Default-Target:-Chrome-69---September-2018-

> Or is there an alternate plan on deprecating Flash support which
> would come into effect this year or early 2019?

No. There are no plans to ship any new Flash deprecation changes in 2018 or early 2019.

> Also is there a similar plan
> in place broken down by upcomping Firefox release versions?

I try to keep the Firefox Plugin Roadmap on MDN up to date:

https://developer.mozilla.org/en-US/docs/Plugins/Roadmap

Comment 11

[Abdul Challawala]

Thanks for the update Chris Peterson!