1830286 - Support site exceptions for clearing recent history / time range clearing

Status: UNCONFIRMED

(Toolkit :: Data Sanitization, enhancement, P5)

Description

[Thomas Meurer]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/112.0
Firefox for Android

Steps to reproduce:

Delete newest chronicle

Actual results:

Cookies with actively defined exceptions not to be deleted when closing Firefox are deleted as well

Expected results:

Cookies with actively defined exceptions not to be deleted when closing Firefox are not deleted when clearing chronicle in an active session.

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Core::Networking: Cookies' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 2

[Kershaw Chang [:kershaw]]

Hi Reporter,

Does this happen on some specific web site or all web site?
It's not clear to me how to reproduce this at my side. Could you provide detailed steps?

Thanks.

Comment 3

[Thomas Meurer]

Yes, it is 100 % reproducible for all websites.

Go to „Settings“ „Privacy and Security“ „Cookies and website data“.
„Cookies und Website-Daten beim Beenden von Firefox löschen“ must be set to on. (Sorry since I am German I did not find an appropriate translation to English on short notice)
Choose „Manage exceptions“.
Define some website for which cookies shall not be deleted when ending Firefox, e.g. https://www.paypal.com.
Go to this website, sign in and allow all cookies.
Now if you restart Firefox and go to „Settings“ „Privacy and security“ „Cookies and website data“ then all cookies are still present for paypal.com

But if you now go to menu point „Chronicle“ in the menu on left top side of Firefox and now choose „Delete newest chronicle“ then all cookies are deleted even if you have set an exception for the side as not to be deleted.

Comment 4

[Thomas Meurer]

Some additional information: In the "Settings" in point "Chronicle" you have to select "Delete Chronicle" when Firefox is closed. In the subpoint "Settings" for chronicle "Delete cookies" must be set as well. If you deselect "Delete cookies" in this submenu for chronicle then "Cookies und Website-Daten beim Beenden von Firefox löschen" is automatically deselected as well. So this is an inconsistent behavior I hope it is clear now. Unfortunately it is now more and more necessary for more websites to allow cookies in order to allow them to identify your computer when you want to relogin and want to avoid that your computer is registered several times like for Paypal, DAZN, Sparkasse Nürnberg etc. otherwise DAZNtells you that the amount of registered devices is exceeded or Paypal asks you to enter each time a TAN, same now as well for Sparkasse Nürnberg etc.. So you have to define exceptions and these exceptions should not be overruled when deleting newest chronicle.

Comment 5

[Valentin Gosu [:valentin] (he/him)]

(In reply to [e-mail] from comment #3)

But if you now go to menu point „Chronicle“ in the menu on left top side of Firefox and now choose „Delete newest chronicle“ then all cookies are deleted even if you have set an exception for the side as not to be deleted.

I'm not totally sure I understand the bug here, but I think that the exceptions list does not actually cover whether the cookies get deleted or not when you manually delete everything?

Paul, maybe you have a better understanding of how this should work?

Comment 6

[Thomas Meurer]

The inconsistency is that there is no chance to define any exception for cookies not to be deleted when going to "Delete newest chronicle" even if you have defined in the settings exceptions for cookies not be deleted when ending Firefox, i.e. as user you explicitly state that you do not want that these cookies are going to be deleted.

Comment 7

[Emma Zühlcke [:emz]]

That's right, we don't look at exceptions outside of clearing on shutdown. Technically we could, but I'm not sure if that would be good UX. Our current assumption is that if a user clears by time range manually, they don't want to preserve any sites that have exceptions.
Ideally we would give users the choice where their exceptions apply, but this seems hard to get right in the current preferences UI.

I think I've seen a similar bug before but I can't find it off-hand.

Comment 8

[Thomas Meurer]

I agree that ideally you should give users choice where their exceptions apply. But If you do want to change this then you should give at least a hint to users who have set exceptions that also these cookies are deleted when clearing recent history in menu point chronicle.

Comment 9

[Emma Zühlcke [:emz]]

My proposal here would hopefully make things clearer: https://bugzilla.mozilla.org/show_bug.cgi?id=1767271#c7
to call them explicitly "shutdown clearing exceptions" or similar.

Comment 10

[Thomas Meurer]

Yes, this proposal looks really good to me because then you have the opportunity to define sites for which you can e.g. completely enable/disbale cookies as user. The current behavior to have only exceptions on shutdown and implicitly no exceptions when clearing recent history is in my opinion very confusing and inconsistent.

Comment 11

[Emma Zühlcke [:emz]]

Side-note: The duckduckgo browser has a concept for "fireproof" sites, which are sites that are exempt from their data clear option. That's very similar to this proposal.