1788639 - Selection by the user to deny notification permissions is not properly reflected in Private Browsing Mode

Status: NEW

(Firefox :: Site Permissions, defect, P3)

Description

[Emma Zühlcke [:emz]]

T1-1 : In Firefox on Windows, Linux, and macOS, the selection by the user to deny notification permissions is not properly reflected in Private Browsing Mode. Specifically, in Private Browsing Mode, when a user selects to deny notification permission, the permission status will be set to “default” not “denied”.

This bug is from the report in Bug 1784741.

Comment 1

[Emma Zühlcke [:emz]]

All permissions in private browsing mode are ephemeral. This is intended behavior.
Temporary permissions are not exposed via the Permissions API. There is an existing bug for that, which I can't find right now.

Does "default" and "denied" refer to the Permissions API?

Comment 2

[Kazuki Nomoto]

Thank you for reviewing our report.

We used the Notification API to get the permission state “default” not the Permissions API.

You can reproduce this by following these steps.

1. launch the Firefox browser
2. Open a website (https://permission.site) in Private Browsing mode)
3. Click notification button on the website to receive the notification permission request.
4. The website requests Notification permission
5. Click “Block” button on the permission request prompts
6. Open “Browser Console” from “Inspect”
7. Input “Notification.permission” and Enter.
8. Check returned value (You can see value “default” not denied)

Comment 3

[BugBot [:suhaib / :marco]]

The severity field is not set for this bug.
:pbz, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 4

[Emma Zühlcke [:emz]]

I can reproduce this issue. It seems unexpected, but I'm not sure if it needs to be a sec-bug. The permission prompt simply shows again when the site requests permission the next time. Since the API is user-activation gated I don't see a high risk of abuse here. Maybe I'm missing something though? Dan, do you agree?

Comment 5

[Emma Zühlcke [:emz]]

Here is the code that sets the temporary permission if in PBM. This temporary permission doesn't seem to be exposed via the Notification API currently. https://searchfox.org/mozilla-central/rev/a3decf626dabd89620171f0ea7840cc4351fe218/browser/modules/PermissionUI.jsm#1120-1121

Comment 6

[Daniel Veditz [:dveditz]]

I agree: this is a bug, but not a security bug. Leaving hidden for now because it's related to other issues in the same report, but that may not be necessary.