Open Bug 1747283 Opened 4 years ago Updated 4 years ago

Calling browser.cookies.get without storeId returns cookie for main context in containers

Categories

(WebExtensions :: General, defect, P3)

Product:
WebExtensions
Component:
General
Version:
Firefox 95
Type:
defect
Points:
2

Tracking

(firefox95 affected, firefox96 affected, firefox97 affected)

Tracking Flags:
Tracking Status
firefox95 --- affected
firefox96 --- affected
firefox97 --- affected

People

(Reporter: apple502j, Unassigned)

References

(Depends on 1 open bug)

Details

Attachments

(1 file)

cookies-bug-test.zip
1.20 KB, application/x-zip-compressed
Details
Attached file cookies-bug-test.zip —

User Agent: Mozilla/5.0 (Windows NT 10.0; rv:100.0) Gecko/20100101 Firefox/100.0

Steps to reproduce:

  1. Install the attached extension. The extension sets cookies of https://httpbin.org and reads it via two methods - browser.cookie.get without storeId, and the sent Cookie header (which the website reflects back.)
  2. On about:addons, allow the extension to run in incognito
  3. Click the browser action. A tab should open.
  4. Set random value on input, then click "Set", setting a cookie on httpbin
  5. Click "Fetch via browser.cookies.get", note the value of the cookie
  6. Click "Fetch via HTTP", confirm the value of the cookie equals step 5 (Good behavior)
  7. Open incognito window
  8. Repeat step 3-6 on incognito using different cookie value. The two values should equal, and neither should equal the value in the previous steps on normal windows. (Good behavior)
  9. Repeat step 3-6 on a container tab (by either copy-pasting URL or via context menu's Open in New Container Tab). (Bad behavior)

Actual results:

The HTTP cookie value and the browser.cookies.get cookie value do not match; the browser.cookies.get cookie value is from the non-container session. This is inconsistent with incognito mode's handling.

Expected results:

The HTTP cookie value and the browser.cookies.get cookie value should match.

Note that the MDN documents that for browser.cookies.get, "[b]y default, the current execution context's cookie store will be used. "

Hello,

I reproduced the issue on the latest Nightly (97.0a1/20211223215735), Beta (96.0b9/20211223202418) and Release (95.0.2/20211218203254) under Windows 10 x64 and Ubuntu 16.04 LTS.

The issue occurs exactly as per the description in the original report.

Status: UNCONFIRMED → NEW
status-firefox95: --- → affected
status-firefox96: --- → affected
status-firefox97: --- → affected
Ever confirmed: true

The severity field is not set for this bug.
:mixedpuppy, could you have a look please?

For more information, please visit auto_nag documentation.

Flags: needinfo?(mixedpuppy)

This is because the implementation only accounts for private and non-private browsing modes when computing the default storeId.

This current implementation is rather complicated, we could simplify the implementation by removing the incognito property and directly deriving the incognito state from context.principal.

After doing that refactoring, it would be rather easy to support this feature request, by reading off context.principal.originAttributes.userContextId after https://searchfox.org/mozilla-central/rev/7271a078fa0c1b858a52614ea60ac82fdd8b3d23/toolkit/components/extensions/parent/ext-cookies.js#246

Severity: -- → S3
Points: --- → 2
Depends on: 1653681
Flags: needinfo?(mixedpuppy)
Priority: -- → P3
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: