1750264 - Disable cookie sameSite schemeful in Firefox 96

Status: VERIFIED FIXED

(Core :: Networking, task)

Description

[Ryan VanderMeulen [:RyanVM]]

Due to regressions reported in the wild tracked in bug 1748693, we're shipping a Normandy pref flip to users on 96.0/96.0.1 to disable the feature (bug 1750257). For 96.0.2, we need to ship this in-tree as well.

Comment 1

[Ryan VanderMeulen [:RyanVM]]

Attachment: Bug 1750264 - Disable cookie sameSite schemeful in Firefox 96. r=dveditz

Comment 2

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9259151 [details]
Bug 1750264 - Disable cookie sameSite schemeful in Firefox 96. r=dveditz

Beta/Release Uplift Approval Request

• User impact if declined: Users may encounter random site bustage
• Is this code covered by automated tests?: No
• Has the fix been verified in Nightly?: No
• Needs manual test from QE?: Yes
• If yes, steps to reproduce:
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): Just a pref flip that we're already shipping a Normandy recipe for
• String changes made/needed:

Comment 3

[Dianna Smith [:diannaS]]

Comment on attachment 9259151 [details]
Bug 1750264 - Disable cookie sameSite schemeful in Firefox 96. r=dveditz

Approved for 96.0.2

Comment 4

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-release/rev/65f109f099c106c182068d87031df6bcdb93d349

Comment 5

[Brindusa Tot, DTE]

Verified on Firefox 96.0.2 Treherder build from https://treeherder.mozilla.org/jobs?repo=mozilla-release&revision=65f109f099c106c182068d87031df6bcdb93d349&searchStr=build, against Windows 10, Ubuntu 20 and macOS 11.4, and I can confirm the followings:

• config paramter is network.cookie.sameSite.schemeful= false
• No Remote feature related to "bug-1750257-rollout-pref-off" is displayed under about:support
• One Normandy preferecences_rollout "bug-1750257-rollout-pref-off-networkcookiesamesiteschemeful-in-release-96-96" event is graduate.

Comment 6

[Hamish Willee]

Docs team updated the docs to indicate this was supported in https://github.com/mdn/content/issues/10857#issuecomment-982280050 . This sounds like you've removed support again.

To be clear, my understanding is that the change is that network.cookie.sameSite.laxByDefault and network.cookie.sameSite.schemeful will now be back to false rather than true by default - is that correct?

Is there any plan to re-enable these?

Note:

• we're tracking doc fixes in https://github.com/mdn/content/issues/12224
• It would be great if you guys could ping us for reversions - since we don't always catch them using the normal process.

Comment 7

[Frederik Braun [:freddy]]

There is a plan to re-enable, but it will take some time. The bugs will be under https://bugzilla.mozilla.org/show_bug.cgi?id=1617609

Comment 8

[Hamish Willee]

Hi @freddy,
Can you confirm the bit above?

"To be clear, my understanding is that the change is that network.cookie.sameSite.laxByDefault and network.cookie.sameSite.schemeful will now be back to false rather than true by default - is that correct?"

Comment 9

[Frederik Braun [:freddy]]

Yes. we disabled the three prefs sameSite=lax, sameSite noneRequiresSecure, and sameSite schemeful for release and beta.

Comment 10

[Hamish Willee]

Thanks very much. FYI I've rolled back FF96 changes in docs now. Looking forward to watching this roll back in again.