1486944 - Make the reject foreign cookie behavior honor the content blocking pref

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, enhancement)

Description

[(no longer active)]

This option is being exposed as part of the Content Blocking UI, so we would like to make it honor the same pref as well.

Comment 1

[(no longer active)]

Attachment: Part 1: Make the reject foreign cookie behavior also depend on the browser.contentblocking.enabled pref

Comment 2

[(no longer active)]

Attachment: Part 2: Add tests to ensure that the reject foreign cookie behavior also depends on the browser.contentblocking.enabled pref

Comment 3

[Mats Palmgren (inactive)]

Is the browser_contentblocking_enabled pref currently non-existent,
and will it be enabled by default when introduced?

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/5fc45a7e2b35
Part 1: Make the reject foreign cookie behavior also depend on the browser.contentblocking.enabled pref; r=baku
https://hg.mozilla.org/integration/mozilla-inbound/rev/b536e2deff08
Part 2: Add tests to ensure that the reject foreign cookie behavior also depends on the browser.contentblocking.enabled pref; r=baku

Comment 5

[(no longer active)]

(In reply to Mats Palmgren (:mats) from comment #3)
> Is the browser_contentblocking_enabled pref currently non-existent,
> and will it be enabled by default when introduced?

That pref is an existing pref, defined here: https://hg.mozilla.org/mozilla-central/file/b75561ff5ffe/modules/libpref/init/StaticPrefList.h#l1270

Comment 6

[Mats Palmgren (inactive)]

Hmm, so if a user currently have blocked 3rd party cookies,
but haven't enabled content blocking, are 3rd party cookies
still blocked or not?  The logic in the patch seems to
suggest it's not - am I missing something?

Comment 7

[Mats Palmgren (inactive)]

Or to phrase it more generally - does these planned changes potentially result
in reduced privacy for any user?

Comment 8

[Tiberius Oros[:tiberius_oros]]

Backed out 5 changesets (bug 1486944)for multiple failures

Backout push: https://hg.mozilla.org/integration/mozilla-inbound/rev/b6be51ee00aa8a2a18962d8074e804d5c75186e0

Pushes with the failures:
https://treeherder.mozilla.org/#/jobs?repo=mozilla-inbound&revision=fef913dda33d078a92d24b526d6e047ca157634b
https://treeherder.mozilla.org/#/jobs?repo=mozilla-inbound&revision=b536e2deff083321e88293769360f3be8042baba

Failures and log files:
- browser chrome failures at browser/components/enterprisepolicies/tests/browser/browser_policy_cookie_settings.js
https://treeherder.mozilla.org/#/jobs?repo=mozilla-inbound&revision=fef913dda33d078a92d24b526d6e047ca157634b&selectedJob=196439983

- xpcshell failures at extensions/cookie/test/unit/test_cookies_thirdparty.js
https://treeherder.mozilla.org/#/jobs?repo=mozilla-inbound&revision=fef913dda33d078a92d24b526d6e047ca157634b&selectedJob=196439061

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/188b13da9862
Part 1: Make the reject foreign cookie behavior also depend on the browser.contentblocking.enabled pref; r=baku
https://hg.mozilla.org/integration/mozilla-inbound/rev/ceb6a933997f
Part 2: Add tests to ensure that the reject foreign cookie behavior also depends on the browser.contentblocking.enabled pref; r=baku

Comment 10

[(no longer active)]

(In reply to Mats Palmgren (:mats) from comment #7)
> Or to phrase it more generally - does these planned changes potentially
> result
> in reduced privacy for any user?

They shouldn't, since the browser.contentblocking.enabled pref is enabled *by default*.  The only case where third-party cookie blocking would stop for the said user is if they go and turn this new pref off, and only if they're blocking all third-party cookies *or* blocking third-party cookies from trackers.

Does this answer your question?

Comment 11

[Arthur Iakab [arthur_iakab]]

https://hg.mozilla.org/mozilla-central/rev/188b13da9862
https://hg.mozilla.org/mozilla-central/rev/ceb6a933997f

Comment 12

[Mats Palmgren (inactive)]

(In reply to :Ehsan Akhgari from comment #10)
> Does this answer your question?

Yes it does, thank you.

> The only case where third-party cookie blocking would stop
> for the said user is if they go and turn this new pref off,
> and only if they're blocking all third-party cookies *or*
> blocking third-party cookies from trackers.

OK, fair enough.  I think it's a rather serious flaw though
that our UI is basically lying now if you do turn content
blocking off and have cookies set to "Blocked: All 3rd party...".
There's no indication whatsoever that that configuration
will not work as advertised.

Perhaps the "Cookies and Site Data" and "Content Blocking"
UIs needs to be integrated now, so that it doesn't mislead
users about what's actually blocked or not.

Comment 13

[(no longer active)]

(In reply to Mats Palmgren (:mats) from comment #12)
> > The only case where third-party cookie blocking would stop
> > for the said user is if they go and turn this new pref off,
> > and only if they're blocking all third-party cookies *or*
> > blocking third-party cookies from trackers.
> 
> OK, fair enough.  I think it's a rather serious flaw though
> that our UI is basically lying now if you do turn content
> blocking off and have cookies set to "Blocked: All 3rd party...".
> There's no indication whatsoever that that configuration
> will not work as advertised.
> 
> Perhaps the "Cookies and Site Data" and "Content Blocking"
> UIs needs to be integrated now, so that it doesn't mislead
> users about what's actually blocked or not.

Indeed, this is something we have also paid attention to.  I'm waiting for a UX mock-up to write the last patch in this series which will finish this UI by addressing this one last major flaw, but while the mock is being made, I filed bug 1487556 to keep track of the work and CCed you there.  :-)