"Allow for Session" cookie permission is increasingly meaningless, it should maybe be replaced with "Allow Until Closed"
Categories
(Core :: Networking: Cookies, task, P3)
Tracking
()
People
(Reporter: el, Unassigned)
References
Details
(Whiteboard: [necko-triaged])
User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:106.0) Gecko/20100101 Firefox/106.0
Steps to reproduce:
The "Allow for Session" cookie permission feels increasingly meaningless, for two reasons: 1. people use more and more mobile devices like an increasing wave of laptops, and also Firefox on Linux phones like PinePhone or Librem 5. Maybe it's just me, but I think on these devices, it's very uncommon to shut down apps permanently or reboot a lot, so a "session" is basically not too far away from just allowing it semi-permanently which defies the point of limiting permissions. 2. an increasing amount of sites begging for cookie permissions and/or trying to somehow track and limit visits just downright break if cookies cannot be stored, which means "Block" is unusable too.
This, I think, illustrates that "Allow for Session" is no longer of much use nowadays and should maybe be changed to something that is more useful.
To reproduce, e.g. go to bloomberg.com with cookies for that host blocked.
Actual results:
If you go to bloomberg.com with cookies blocked, the article won't load. If you use "Allow for Session", the site tracks and spies on you until Firefox closes, which as reasoned above may as well be for weeks or months. There is no middle ground offered by Firefox's cookie settings that is actually useful and private.
Expected results:
"Allow for Session" should maybe be replaced with something like "Allow Until Closed", where cookies are cleared as soon as the last tab pointing to the site was closed. This would limit the cookie duration to a single visit rather than the potentially weeks or months of a session, while not breaking sites like a full block often does. That sort of granularity would actually be useful for many modern websites where neither "Block" nor "Allow for Session" really are.
|
||
Comment 1•3 years ago
|
||
The Bugbug bot thinks this bug should belong to the 'Core::Networking: Cookies' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.
|
||
Comment 2•3 years ago
|
||
dveditz, what do you think about this?
|
||
Comment 3•3 years ago
|
||
This is a long-standing problem (see the 'eternalsession' bug 530594) and this proposal is probably the most commonly wanted solution. It conflicts with people who want to be able to reopen a recently-closed tab and have it "work": with this scheme you'd always be signed out when you did that on a session-only site. Maybe we need to put a time-limit on "recently closed tabs" so we can clear their session cookies? Then again, if we can purge the cookies from Necko's memory when a site gets fully closed then the session-restore copy only comes into play in the occasional times someone actually restores a closed tab.
There's nothing wrong with the wording "Allow for Session", and it's common in the industry. The problem is Firefox's definition of a "session" is extreme. In fact, "Allow Until Closed" might be even more misleading since it would be more likely to be interpreted as when Firefox is closed and not understood to be when the last tab of a "site" was closed. As of bug 529899 we should be clearing session cookies when we close Firefox even if you've selected to "reopen tabs from last time", so that's somewhat better that it used to be.
This is also complicated by the fact that lots of sites could be loading common 3rd party resources with session cookies. When would you clear those? It would be hard to keep track of all the places they are potentially used. This is less of a problem if Total Cookie Protection is active since they'll all be in different "cookie jars" anyway, but there are still some exceptions for sites e.g. with the Storage Access API.
TL;DR: I'm all in favor of fixing this, but a solution won't be as simple as it seems on the surface.
Hm, in my personal opinion, even some best effort lenient model could be a huge improvement, e.g. track for each cookie which hosts it was set from if none of them is a full "allow" (but only for a "session"), and if all tabs of these hosts are ever closed at any moment in time, erase it.
While this would in theory favor e.g. those cookies that are such omnipresent that they manage to stick to any open tab at any time for most average users anyway, those are already likely to be targeted by the enhanced tracking protection anyway. Or if they aren't, they probably won't manage to stay alive forever with enough tabs unless the user really is super actively using these services in some sort of notion of ongoing "session" anyway, if you want to call it that.
I think that would already be a big improvement because it seems like that would at least make it somewhat POSSIBLE cookies of sites I left actually do get wiped timely. Right now with how "allow for session" works, it doesn't even seem realistic they won't just always stick around for weeks unnecessarily, and that's just kind of frustrating. Any sort of increased effectiveness would be nice, if you ask me.
As for recently closed: yeah, I think a time limit would make most sense. Even now, if I open something from recently closed, some JavaScript may decide that for some reason the session is over and wipe all form contents etc. (or the server may no longer allow me to submit it if some notion of session expired despite local cookies remaining) so I think there is just inherently no way that it can be guaranteed all session information remains, whether "allow for session" cookies are involved or not. Of course it would make such problems more likely, but that can also be seen as a feature, after all "allow for session" is a manual opt-in feature that people use on some sites for a reason.
Brave has a mechanism for this called "Forget me when I close this site" which mirrors what I was thinking of. It seems to be tied to the last tab being closed.
Description
•