1477835 - Some AOL properties seem to be exempted from cookie restrictions

Status: RESOLVED INVALID

(Firefox :: Protections UI, defect, P3)

Description

[(no longer active)]

STR:

1. Clear all site data.
2. Navigate to https://techcrunch.com/2018/07/23/xage-secures-12-million-series-a-for-iot-security-solution-on-blockchain/.
3. The following domains set cookies: dtm.advertising.com and cdn.at.atwola.com.  Both advertising.com and atwola.com are on the TP list: https://github.com/mozilla-services/shavar-prod-lists/blob/master/disconnect-blacklist.json#L115

The following requests are logged in the network panel to these domains, with a Set-Cookie header in the response:

  * A GET request to <https://at.atwola.com/addyn/3.0/5071.254/-1/0/0/noperf=1;extmirroring=0;alias=93484988;kvvert=;click=https://at.atwola.com/adlink/5113.1/3739779/0/225/AdId=5668851;BnId=12;guid=1Acef866be-8eb8-11e8-b9c1-a0d3c101f574;itime=378515373;gdpr=0;nodecode=yes;impref=1532378515421465017;imprefseq=97961203560614618;imprefts=1532378515;spaceid=1197802919;link=;ord=378515373?>, responding with `Set-Cookie: ADMARK=Mon, 23 Jul 2018 20:41:56 GMT;expires=Mon, 23 Jul 2018 20:43:56 GMT;domain=atwola.com;path=/`.
  * A GET request to https://pixel.advertising.com/ups/55856/sync?uid=785667041898878596 with two headers: `Set-Cookie: IDSYNC="38~1f4k:e2d~1f4k:ehg~1f4k:exi~1f4k:f43~1f4k:16pp~1f4k:173l~1f4k:175s~1f4k:176k~1f4k:17jq~1f4k:17kh~1f4k:18ul~1f4k:18vc~1f4k:NaN~1f4k:175t~1f4k:175u~1f4k:173k~1f4k";Version=1;Domain=.advertising.com;Path=/;Max-Age=31622400;Expires=Wed, 24-Jul-2019 20:42:03 GMT` and `Set-Cookie: APID=1Acef866be-8eb8-11e8-b9c1-a0d3c101f574;Version=1;Domain=.advertising.com;Path=/;Max-Age=31622400;Expires=Wed, 24-Jul-2019 20:42:03 GMT`.

Comment 1

[Andrea Marchesini [:baku]]

I'm not able to reproduce this issue. Do you see cookies in cookies.sqlite?
I tested this issue adding a breakpoint in the parent process in nsCookieService::SetCookieStringCommon but I don't see cookies stored by atwola.com.

Comment 2

[(no longer active)]

(In reply to Andrea Marchesini [:baku] from comment #1)
> I'm not able to reproduce this issue. Do you see cookies in cookies.sqlite?

I see them in devtools -> storage -> cookies.  I also get them in cookies.sqlite.  Here is a dump of that DB from a fresh profile after navigating to the site in comment 0: https://pastebin.mozilla.org/9090401

> I tested this issue adding a breakpoint in the parent process in
> nsCookieService::SetCookieStringCommon but I don't see cookies stored by
> atwola.com.

I wonder what the difference is, perhaps because I'm viewing the site from Canada?

Comment 3

[(no longer active)]

I captured an rr trace of this.  Will investigate myself.

Comment 4

[(no longer active)]

It seems like this is the side effect of our entity list whitelisting considering AOL trackers being whitelisted on techcrunch.com (https://github.com/mozilla-services/shavar-prod-lists/blob/f16248d7f33367bb3c48d72fb32fdb239dbe0c8e/disconnect-entitylist.json#L1892).