1817596 - Firefox >DOES< save cookies in private mode

Status: RESOLVED DUPLICATE of bug 1814733

(Core :: Privacy: Anti-Tracking, defect)

Description

[scottaw001]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/110.0

Steps to reproduce:

1. (in normal mode) I check cookies: settings-> cookies and site data -> manage data -> (specifically "arkadium.com") and it is not there.
2. open a new private window
3. go to arkadium.com (I'm not sure it matters, but I play "classic solitaire"
4. Close the private window
5. (Back in normal mode) check cookies: settings-> cookies and site data -> manage data -> (specifically "arkadium.com") and it >is< there.

Actual results:

A website visited in private mode places cookies in normal mode.

Expected results:

Cookies, in private mode, should not appear in normal mode.

Comment 1

[BugBot [:suhaib / :marco]]

The Bugbug bot thinks this bug should belong to the 'Firefox::Private Browsing' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 2

[Francesco Lodolo [:flod]]

I can't reproduce (and I even checked that the cookies were set in private mode, via Devtools -> Storage).

Can you replicate it on a clean profile or in safe mode?

Comment 3

[scottaw001]

Yes, I can reproduce it in both Safe Mode and with a clean profile.

A correction to step 3. Starting a game does make the difference. The cookie doesn't appear (in the private window or the normal window) until a game is selected (specifically Classic Solitaire, I have not tested it with other games). Playing the game isn't required, just starting it. I wanted until after the 7 second delay that may or may not present an ad. I normally use an add blocker, but not in safe mode or with the clean profile.

After that the game the arkadium cookie is present in both the normal and private windows.

Comment 4

[Ina Popescu, Desktop QA]

I've reproduced this issue following STR from Comment 0 and Comment 3 using the latest Nightly 112.0a1 and Firefox 110.0 on Windows 10 x64, Ubuntu 22.04 and macOS 13.

Also I've narrowed down the regression range to:
Last good revision: 15511dd87eaacbeb20d29719ea28400400d679c8
First bad revision: 18c8a1d1ff992e0a75ea6eaf510f2d7d519eba46
Pushlog:
https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=15511dd87eaacbeb20d29719ea28400400d679c8&tochange=18c8a1d1ff992e0a75ea6eaf510f2d7d519eba46

Comment 5

[BugBot [:suhaib / :marco]]

:saschanaz, since you are the author of the regressor, bug 1784590, could you take a look?

For more information, please visit auto_nag documentation.

Comment 6

[Kagami Rosylight 🏳️‍🌈🏳️‍⚧️ [:saschanaz] (they/them)]

My previous experience says some behavior changes were hidden in PBM by some prefs which are removed by https://phabricator.services.mozilla.com/D154578#change-snxvCxzhFNv0. Can you retry bisection with those prefs disabled? Thanks!

Comment 7

[Kagami Rosylight 🏳️‍🌈🏳️‍⚧️ [:saschanaz] (they/them)]

Tried this myself but arkadium.com never appears in the "cookies and site data". I do see Devtools->Storage have cookies but that was it. Can you share what you see?

Comment 8

[Emma Zühlcke [:emz]]

I can't reproduce this either on Nightly on macOS.

Comment 9

[:Gijs (he/him)]

(In reply to Kagami [:saschanaz] from comment #6)

My previous experience says some behavior changes were hidden in PBM by some prefs which are removed by https://phabricator.services.mozilla.com/D154578#change-snxvCxzhFNv0. Can you retry bisection with those prefs disabled? Thanks!

Ina did you see this question / did you mean to clear your needinfo?

Comment 10

[Ina Popescu, Desktop QA]

Attachment: arkadium.com.7z

(In reply to Kagami [:saschanaz] from comment #6)

My previous experience says some behavior changes were hidden in PBM by some prefs which are removed by https://phabricator.services.mozilla.com/D154578#change-snxvCxzhFNv0. Can you retry bisection with those prefs disabled? Thanks!

I've retested this with pref dom.indexedDB.hide_in_pbmode.enabled set to false and managed to reproduce this issue in the latest Nightly 112.0a1 and Firefox 110.0. Please let me know if you are referring to a different pref to test with.

Please note that youtube.com is stored in Settings-> Cookies and Site Data -> Manage Data when accessing the game https://www.arkadium.com/games/classic-solitaire/ in New private window using Nightly and Firefox Beta. Otherwise it is stored as arkadium.com when the game is accessed in New private window using Firefox Release.
See also the attachment while testing with pref dom.indexedDB.hide_in_pbmode.enabled set to false.

I've double checked the regression range for this and I got same culprit Bug 1784590.

Comment 11

[:Gijs (he/him)]

Given the regressor (pref or otherwise), I guess this should be looked at further by the indexeddb folks.

Comment 12

[Kagami Rosylight 🏳️‍🌈🏳️‍⚧️ [:saschanaz] (they/them)]

(In reply to Ina Popescu from comment #10)

Please note that youtube.com is stored in Settings-> Cookies and Site Data -> Manage Data when accessing the game https://www.arkadium.com/games/classic-solitaire/ in New private window using Nightly and Firefox Beta. Otherwise it is stored as arkadium.com when the game is accessed in New private window using Firefox Release.
See also the attachment while testing with pref dom.indexedDB.hide_in_pbmode.enabled set to false.

The YouTube thing is technically a different (known) one, although still a bug. It's interesting that the stable release shows a different behavior than an equivalent Nightly build, probably a pref flip? Thank you for the details 👍

Comment 13

[Kagami Rosylight 🏳️‍🌈🏳️‍⚧️ [:saschanaz] (they/them)]

Indeed, a simulated release build from today's moz-central can reproduce comment #0. Will try getting the relevant pref and run mozregression with the flip.

Comment 14

[Kagami Rosylight 🏳️‍🌈🏳️‍⚧️ [:saschanaz] (they/them)]

Got the new regression range, with the following prefs disabled:

• dom.caches.hide_in_pbmode.enabled
• dom.indexedDB.hide_in_pbmode.enabled
• dom.serviceWorkers.hide_in_pbmode.enabled
• privacy.annotate_channels.strict_list.enabled
• privacy.annotate_channels.strict_list.pbmode.enabled

Mozregression gave https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=a7402247dc7e4b5c0a4a173aa08545075a03f481&tochange=cd3007f4be5d49ea21cadf77ef79f8d0aa798b3d, where bug 1758745 is the most suspicious one.

Hi Tom, could you take a look? Thanks!

Comment 15

[:Gijs (he/him)]

Paul did bug 1814733 resolve this, too?

Comment 16

[Emma Zühlcke [:emz]]

Could have, it depends on which storage is actually at fault here. The manage data UI covers quota storage too so it may not actually cookies that are affected here. Let me re-test with latest central and Kagami's pref config.

Comment 17

[Emma Zühlcke [:emz]]

I've tested with and without the patch applied. Looks like the manage data UI entry is not for cookies but about the leak we fixed in bug 1814733. We can mark this bug as a duplicate. But let's double check - Ina, can you still reproduce the issue in the latest Nightly version with the prefs set/disabled from comment 14?

Comment 18

[Ina Popescu, Desktop QA]

(In reply to Paul Zühlcke [:pbz] from comment #17)

I've tested with and without the patch applied. Looks like the manage data UI entry is not for cookies but about the leak we fixed in bug 1814733. We can mark this bug as a duplicate. But let's double check - Ina, can you still reproduce the issue in the latest Nightly version with the prefs set/disabled from comment 14?

The issue is no longer reproduceable in the latest Nightly 112.0a1 version with the prefs from Comment 14 set to true or false.

Comment 19

[Emma Zühlcke [:emz]]

Thanks! In that case I'll dupe the bug.

Comment 20

[scottaw001]

I am again seeing cookies from arkadium.com when I play their games in private mode.

I've tried many times to reproduce it but it doesn't always happen, even when I play the same games. Still, I thought it was worth mentioning.

I'll provide updates when I have more information.

Comment 21

[Emma Zühlcke [:emz]]

(In reply to scottaw001 from comment #20)

I am again seeing cookies from arkadium.com when I play their games in private mode.

I've tried many times to reproduce it but it doesn't always happen, even when I play the same games. Still, I thought it was worth mentioning.

I'll provide updates when I have more information.

I can reproduce this with youtube.com, we're tracking it in Bug 1868448. Seems to be a UX issue though, we don't actually leak private browsing data.

Comment 22

[Daniel Veditz [:dveditz]]

Sorry for the burst of bugspam: filter on tinkling-glitter-filtrate
Adding reporter-external keyword to security bugs found by non-employees for accounting reasons