155065 - When removing a cookie from a site with Don't allow removed cookies to be reaccepted later it blocks all cookies from the domain rather than just the cookie that has been removed.

Status: RESOLVED INVALID

(Core :: Networking: Cookies, defect)

Description

[John McCann]

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.1a) Gecko/20020611
BuildID:    2002061104

A cookie is identified by 3 values the Name, the Domain/host, the path (possible
a fourth I haven't read the RFC but secure cookies maybe defined separetly ).

Using the cookie manager the user has an option to block a cookie which should
be identified by those three values.

When a user does this though the cookie is blocked either by the Domain and path
or just the Domain  I am unsure as I have not test with different paths.

Reproducible: Always
Steps to Reproduce:
1. Go to a site with multipul cookies in the same path
2. Allow you broswer to be tagged with the cookies
3. Open the cookie manager enable blocking of removed cookies and delete 1
cookie and close the manager
4. Reopen the manager and remove the cookies with blocking of removed cookies
disabled
5. Try to re-accept the cookies.

Actual Results:  All the cookies for the Domain/Path combo are blocked.

Expected Results:  All the cookies are accepted expect the cookies that have
been removed with "Don't allow removed cookies to be reaccepted later" should be
reaccepted.

Comment 1

[Stephen P. Morse]

> A cookie is identified by 3 values the Name, the Domain/host, the path
> (possible a fourth I haven't read the RFC but secure cookies maybe defined
> separetly ).

A cookie is uniquely identified by its name and host/domain.  If you set two 
cookies with the same name for the same host but having different paths, the 
second will overwrite the first

> Using the cookie manager the user has an option to block a cookie which should
> be identified by those three values.

The cookie manager does not block individual cookies.  Rather it blocks specific 
hosts from setting cookies.

> When removing a cookie from a site with Don't allow removed cookies to be
> reaccepted later it blocks all cookies from the domain rather than just the
> cookie that has been removed.

That is the intended behavior.  I can see where it could be confusing because 
the wording on the checkbox doesn't mention that all cookies from the same host 
are to be blocked.  But that can be cleared up with a wording change:

So I'm closing this out as invalid and opening up a new bug for the wording 
change.  The new bug is bug 155078.

Comment 2

[Stephen P. Morse]

> A cookie is uniquely identified by its name and host/domain.  If you set two 
> cookies with the same name for the same host but having different paths, the 
> second will overwrite the first

I stand corrected.  The path is also necessary to uniquely identify the cookie.  
I don't know what I was thinking when I wrote the above.

However cookie blocking is done by host/domain only, not by path.