1619091 - "First Party Isolation" and "Block all cookies", both conflict with add-ons

Status: RESOLVED WORKSFORME

(Core :: Networking: Cookies, defect)

Description

[esthermoellman]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:75.0) Gecko/20100101 Firefox/75.0

Steps to reproduce:

1. Do a fresh latest Nightly' install + restart twice.

2. At about:config => privacy.firstparty.isolate: TRUE => Restart.

3. At about:preferences => Privacy and Security:
   Block all cookies
   Set Nightly to delete everything at close (VERY IMPORTANT: Every-time Nightly' launches, must to be totally cache clean, cookies deleted etc. Otherwise, the issue won't appear because Nightly will use stored stuff).

4. Restart Nightly.

5. Load the following webpages, and white-list them (At MenuBar => mouse-click shield icon (Enhanced Tracking Protection on the left of UrlBar) => A popup will open => Turn off the main button => Confirm by seeing broken shield icon at MenuBar saying the webpage has Enhanced Tracking Protection OFF). If all cookies are blocked, these webpages are not going to load. They only will load if are white-listed at Enhanced Tracking Protection:
   https://imgur.com/
   https://userstyles.org/
   https://outlook.live.com/owa/ (here also will be needed to white-list https://login.live.com/cookiesDisabled.srf? and in order to test this page, "Sign in" must be clicked).
   https://www.imdb.com/title/tt8946378/ (the test here will be by mouse-clicking the video. If Enhanced Tracking Protection is ON, the video will be blocked - because needs cookies. White-list the webpage, and the video will work).

Why 4 webpages? Because it is not easy to reproduce the issue.
And these 4 pages only work when Enhanced Tracking Protection is OFF.
AGAIN, VERY IMPORTANT: imgur.com and usertyles.org are easy to test. But in order to test:
https://outlook.live.com/owa/ ("Sign in" must to be clicked)
https://www.imdb.com/title/tt8946378/ (video need to be clicked)

6. Restart => Check everything is working fine, webpages are white-listed and loading without problems.

7. Do a FireMonkey clean install (https://addons.mozilla.org/en-US/firefox/addon/firemonkey/) => Restart.

8. Create any new CSS inside Firemonkey. For example:

/*
==UserCSS==
@name 12bytes
@match ://.12bytes.org/*
@run-at document-start
==/UserCSS==
*/

.post-thumbnail { background: transparent !important }

PS: You don't need a specific CSS/JS' scripts in order to see the issue. You can use any CSS/JS' script with the 4 webpages I pointed. There is no relation between the CSS/JS' script and the 4 webpages. Any CSS/JS' script will trigger the issue if the 4 webpages I mentioned are used.

9. Restart and ensure Nightly will clean cache, cookies and everything.

10. Test one by one each webpage at point "5)" above. It's important not to use pinned tabs, nor saved session etc. Test each webpage from the scratch, in a new tab, no cache, no cookies etc.
    AGAIN, VERY IMPORTANT: imgur.com and usertyles.org are easy to test. But in order to test:
    https://outlook.live.com/owa/ ("Sign in" must to be clicked)
    https://www.imdb.com/title/tt8946378/ (video need to be clicked)

Actual results:

You may see the following possibilities:

• One of the webpages is not fully loaded. Even if white-listed (and icon at NavBar confirms this), cookies are blocked. If you blacklist and white-list again, the webpage may work, but you will need to do that every-time you load the webpage with cache/cookies cleaned.

• Another possibility is that you will see more than one webpage not fully working, same reason, same process, same previous explanation.

• But if all the webpages are loading, then in order to reproduce the issue, please create another CSS inside FireMonkey. Generally with just one CSS' script (any script), the issue already appears at least for one webpage (mentioned above). But sometimes all the 4 tested webpages are loading, and in this case the only way to reproduce the issue, is to start adding CSS and JS' scripts. At some point, with one CSS' script or more CSS/JS' scripts, the issue will appear, and webpages are not going to be fully loaded.

Expected results:

I never had before incompatibilities between First Party Isolation + Block all cookies + FireMonkey. Once webpages are white-listed at Enhanced Tracking Protection, webpages worked perfectly with FireMonkey.

If I do one of the following 3 things, the issue doesn't appear, and everything works fine:
Disable First Party Isolation.
OR
Disable Block all cookies.
OR
Disable FireMonkey.

The 3 together trigger the issue.
If one of the 3 is disabled, the issue doesn't appear.

I talk to the FireMonkey' Dev, and he ensures me that is a Firefox' bug.

Comment 1

[esthermoellman]

I did a "detective job" by testing one by one each Nightly' version from the latest to the oldest, and I found that Nightly 02/24/2020 (https://download-origin.cdn.mozilla.net/pub/firefox/nightly/2020/02/2020-02-24-09-47-51-mozilla-central/firefox-75.0a1.en-US.win64.installer.exe) has not the bug I reported.

I tested Nightly 02/25/2020 and it has the bug I reported.
So, it seems the bug appeared at Nightly between day 02/24/2020 and day 02/25/2020.

Comment 2

[Jeronimo Torti (Please send NI request to Brindusa Tot)]

Hi,
After following all of the steps and especifications, I was unable to reproduce this issue on my end, I tried on Windows 10, with Firefox Nightly version 75.0a1 (2020-03-05) (64-bit)

If you can still reproduce this issue, would you send a screenshot or a video of the bug?

Thanks, I'm choosing a component for this bug in hope that someone with more expertise may look at it.
We'll await their answer. If is not the correct component please feel free to change it to an appropriate one.

Regards,
Jerónimo.

Comment 3

[esthermoellman]

(In reply to Jerónimo Torti from comment #2)

Hi,
After following all the steps and especifications, I was unable to reproduce this issue on my end, I tried on Windows 10, with Firefox Nightly version 75.0a1 (2020-03-05) (64-bit)

If you can still reproduce this issue, would you send a screenshot or a video of the bug?

Thanks, I'm choosing a component for this bug in hope that someone with more expertise may look at it.
We'll await their answer. If is not the correct component please feel free to change it to an appropriate one.

Regards,
Jerónimo.

Hi Jerónimo,

Yes, I can still reproduce this issue.
Also as I mentioned days ago, I found that before Nightly 02/24/2020 the issue is not there, only after 02/25/2020.

And yes, I believe a video will be better to show the issue.
But please I need help, please inform me what kind of video will be better for this task. I know how to do that with youtube, but perhaps you know a better tool.

PS: Sorry, I don't have enough knowledge/experience to decide which one should be the best "component for this bug". In my own words, this is a Nightly' bug (not an add-on bug), the bug is just triggered by a specific add-on, and the bug seems to interfere with (file) permissions.sqlite, because a (Enhanced Tracking Protection) whitelisted webpage, even confirmed as whitelisted, it can't be fully loaded. Yeah, the bug is related to cookies, and when "Block all cookies" is changed, the bug disappears. But it's not only related to cookies, because if I keep "Block all cookies", but I change about:config => privacy.firstparty.isolate to FALSE, the bug also disappears. It's a tricky bug. I believe it has more than one source of cause (cookies?, first party isolation?, API of the add-on?).

Comment 4

[Dragana Damjanovic [:dragana]]

Ehsan, can you look at this?

Comment 5

[esthermoellman]

(In reply to Jerónimo Torti from comment #2)

If you can still reproduce this issue, would you send a screenshot or a video of the bug?

Jerónimo,

Here is the video: https://youtu.be/thhUQ2tjVTo
I did my best. Sorry for the low quality.

Comment 6

[Jeronimo Torti (Please send NI request to Brindusa Tot)]

Thank you for the video, it's very clear.

I was able to reproduce now on I tried on Windows 10, with Firefox Nightly version 75.0a1 (2020-03-05) (64-bit) and Beta version 74.0b9 (64-bit). In previous test, I missed select 'Custom' preference to block the cookies, although I chose delete everything when closing Nightly.

I'm updating the bug as 'New', and respective flags.

Thanks!

Jerónimo

Comment 7

[Nhi Nguyen (:nhi)]

Ehsan, could you take a look at this one? Thanks!

Comment 8

[Luca Greco [:rpl] [:luca] [:lgreco]]

I tried to bisect the commit where the regressed behavior starts, bisecting it with mozregress point to the following push:

• https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=05fcd5b647bdf365fc838069ddb94d4f8f4b4af4&tochange=2a7cb2d7412db03c6fa3695add44870c221c5b2b

which contains a single commit, landed from Bug 1617205.

(during the bisect with mozregression I had to do a couple of manual steps on every run to be sure to trigger the issue, in particular: "clearing the cookies, disable/re-enable the extension and open the imdb url in a new tab", but hopefully I didn't miss any of the manual steps during the bisect and the mozregress result may help us to figure out what is the actual underlying issue).

Comment 9

[esthermoellman]

Today (03/28/2020) I'm using Nightly Version 76.0a1 Build ID 20200327215207 and in my tests the bug is not appearing anymore.
For the next 2 weeks I'll keep watching the situation and doing more tests. If the bug disappears for good and doesn't come back, I'll request here the closure of this bug report.

Comment 10

[BugBot [:suhaib / :marco/ :calixte]]

Bugbug thinks this bug is a regression, but please revert this change in case of error.

Comment 11

[Luca Greco [:rpl] [:luca] [:lgreco]]

I wanted to point out that based on comment 9 it looks that Firefox 76 may not be affected by the issue, but it isn't clear what changed between the time the issue has been reported and the first nightly version that may not be affected anymore.

That's the reason why I added the regressionwindow-wanted keyword to this issue.

Comment 12

[Daniel Bodea [:danibodea]]

I couldn't reproduce this issue either. I did, tho, on a specific build the reporter mentioned to fail, on a Nightly v75.0a1 from 2020-02-25, on Win 10 x64. Has to be caused by something we are missing or just user error. In any case, considering the reporter's comment 9, I will set this issue as worksforme.

@esthermoellman: if you see it again, let us know.
Thank you for your contribution!