Closed Bug 1546653 Opened 7 years ago Closed 7 years ago

Private Browser session leaks notification settings

Categories

(Core :: DOM: Push Subscriptions, defect)

Product:
Core
Component:
DOM: Push Subscriptions
Version:
66 Branch
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED DUPLICATE of bug 1422056

People

(Reporter: benjamin, Unassigned)

Details

User Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:66.0) Gecko/20100101 Firefox/66.0

Steps to reproduce:

  1. Open a Private Window, CTRL+SHIFT+P
  2. Navigate to a website with web push notifications, for instance reddit.com
  3. Allow notifications
  4. Close the session.

Actual results:

Go to your settings and see that the notifications are still subscribed to. Alternatively, wait for a notification from [Website] to show up - it will!

Expected results:

One should not be able to subscribe to any kind of permanent website permissions setting in a Private Session.

Location settings do NOT behave this way, I can allow a website access to location data, but after closing the session, the permission is correctly gone.

Hello!

I have been trying to replicate this Using Firefox 66.0.3 (64bit) on Ubuntu.

  1. With a brand new profile i had only 1 window in private browsing as you mentioned.
  2. Then i went to www.reddit.com and sign in.
  3. Before entering username and password i was given the option to allow notifications so i set it as yes.
  4. Then i went to Preferences> Privacy & Security > Notifications > settings > and i do see reddit.com listed
  5. Then i closed the browser window and launched it again normal + also in private.
  6. after that when i go to Preferences> Privacy & Security > Notifications > settings > (i don´t see reddit anymore)

regards.

Oh interesting Pablo, I hadn't tried to restart Firefox. Thanks for triaging. I can confirm that it disappears after a restart.

But I think it's still a bug.

I think it's normal to have a Firefox session open for weeks, so this would still cause a leak. It also raises other odd questions, like will it then be restored upon a crash or an update?

Component: Untriaged → DOM: Push Notifications
Product: Firefox → Core

Johann, have you seen this?

Flags: needinfo?(jhofmann)

This is a known issue, there are two problems here:

  • We are dropping origin attributes in the permission manager (bug 1422056)
  • AFAIK all private browsing sessions use the same private browsing id

Duping to bug 1422056, since that is probably going to make the biggest difference.

Status: UNCONFIRMED → RESOLVED
Closed: 7 years ago
Flags: needinfo?(jhofmann)
Resolution: --- → DUPLICATE
You need to log in before you can comment on or make changes to this bug.