1658231 - Web Notification API in Fenix shares private mode cookie with normal mode

Status: RESOLVED FIXED

(Fenix :: General, defect)

Description

[Muneaki Nishimura]

Attachment: notification_tracker.gif

Similar to Bug 1657251, icon request of Web Notification API in Fenix shares private browsing mode cookie with normal browsing mode. Also the cookie value is kept after restart even when Delete browsing data on quit is enabled.
The reason is that icon request is sent from native code and that shares cookie store between private and normal mode. Also, it that cookie store is not in scoped of Delete browsing data on quit feature.
https://github.com/mozilla-mobile/android-components/blob/master/components/feature/webnotifications/src/main/java/mozilla/components/feature/webnotifications/NativeNotificationBridge.kt#L74

That allows website to track his/her users even when they use private browsing mode.

Here is the reproduction way (see attached image for the demo).

1. Launch https://csrf.jp/2020/notification in normal browsing mode
2. Set the name 'public' to form and submit
3. Tap "Enable Notification" button and allow for the domain
4. Launch https://csrf.jp/2020/notification in private browsing mode
5. Set the name 'private' to form and submit
6. Tap "Enable Notification" button again and allow for the domain
7. Tap "Show Notification" button (in private mode tab)
8. Fenix tries to retrieve icon to tracker.php and then tracking cookie user=private is set by the response
9. Open the normal browsing mode tab 1)
10. Tap "Show Notification" button (in normal mode tab)
11. Fenix sends icon request to tracker.php with user=private in cookie that is set by 8)

Comment 1

[Roger Yang [:royang]]

Attachment: webnotification_private_1.patch

As suggested, all web notification icon request will be set to private so we don't send cookies in the request.

Comment 2

[James Willcox (:snorp) ([e-mail]) (he/him)]

Comment on attachment 9169249 [details] [diff] [review]
webnotification_private_1.patch

Review of attachment 9169249 [details] [diff] [review]:
-----------------------------------------------------------------

::: components/browser/icons/src/main/java/mozilla/components/browser/icons/loader/HttpIconLoader.kt
@@ +43,4 @@
>          val downloadRequest = Request(
>              url = resource.url,
>              method = Request.Method.GET,
> +            cookiePolicy = if (request.isPrivate) Request.CookiePolicy.OMIT else Request.CookiePolicy.INCLUDE,

I think you probably just want to set this to `OMIT` all the time.

Comment 3

[Roger Yang [:royang]]

(In reply to James Willcox (:snorp) ([e-mail]) (he/him) from comment #2)

I think you probably just want to set this to OMIT all the time.

I see. I've attached a new patch. Thanks

Comment 4

[Roger Yang [:royang]]

Attachment: webnotification_private_2.patch

Comment 5

[Sebastian Kaspari (:sebastian; :pocmo)]

Comment on attachment 9169259 [details] [diff] [review]
webnotification_private_2.patch

Review of attachment 9169259 [details] [diff] [review]:
-----------------------------------------------------------------

HttpIconLoader was already patched in `master` and all release branches in bug 1657251. Does this patch still apply on the latest master state?

Comment 6

[Sebastian Kaspari (:sebastian; :pocmo)]

(In reply to James Willcox (:snorp) ([e-mail]) (he/him) from comment #2)

I think you probably just want to set this to OMIT all the time.

In bug 1657251 we patched it to be conditional?

Comment 7

[Roger Yang [:royang]]

Attachment: webnotification_private_3.patch

Updated to work with latest master

Comment 8

[Oana Horvath [:ohorvath]]

Verified as fixed on both RC 79.0.5 & Beta 80.0.1 builds: the private cookie is not shown in normal browsing mode.

Comment 9

[Daniel Veditz [:dveditz]]

Given the user interaction requirements (users rarely grant notification permission -- single digit percentages, and lots of users block requests for all domains) we're not sure this strictly qualifies for the bounty, but we are appreciative of being able to fix this privacy issue.