1892494 - Only enable BounceTrackingProtection when 3rd party cookies are restricted

Status: RESOLVED FIXED

(Core :: Privacy: Anti-Tracking, task, P1)

Description

[Paul Zühlcke [:pbz]]

The feature only provides meaningful protection if 3rd party cookies are already restricted. I recommend to enable the feature only for cookie behavior 1,3,4,5. That matches the behavior of the existing redirect tracking protection.
See https://searchfox.org/mozilla-central/rev/8c3ca2f5a74e0ba59c3d9dddf5468a2ffab13467/netwerk/cookie/nsICookieService.idl#59-65 for a list of supported cookie behaviors.

We need to take private browsing into account which can have a separate cookie behavior value than normal browsing.

Edit: This might be a good place to add the logic: https://searchfox.org/mozilla-central/rev/8c3ca2f5a74e0ba59c3d9dddf5468a2ffab13467/toolkit/components/antitracking/bouncetrackingprotection/BounceTrackingState.cpp#57,66
We can check for private browsing there. For better performance we can additionally consider stopping the entire service when both normal browsing and private browsing cookie behavior are unsupported.

Comment 1

[Paul Zühlcke [:pbz]]

Manuel, would you like to take this one?

Comment 2

[Manuel Bucher [:manuel]]

Thanks for detailed description. Yes, would like to take.

Comment 3

[Manuel Bucher [:manuel]]

Attachment: Bug 1892494 - Only enable BounceTrackingProtection when it provides meaningful protection r=pbz

BounceTrackingProtection only provides meaningful protection when 3rd
party cookies are restricted.

Disable it when

• BEHAVIOR_ACCEPT: Cookies aren't partitioned at all due to and trackers
  don't need to rely on redirects for tracking
• BEHAVIOR_REJECT: Cookies aren't stored anyway and there is nothing for
  us to clear

All other current modes BEHAVIOR_REJECT_FOREIGN, BEHAVIOR_LIMIT_FOREIGN,
BEHAVIOR_REJECT_TRACKER and BEHAVIOR_REJECT_TRACKER_AND_PARTITION_FOREIGN
partition cookies.

Comment 4

[Manuel Bucher [:manuel]]

Attachment: Bug 1892494 - Add tests r=pbz

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/4c6f90c2cac0
Only enable BounceTrackingProtection when it provides meaningful protection r=pbz,anti-tracking-reviewers
https://hg.mozilla.org/integration/autoland/rev/68549f95ad04
Add tests r=pbz,anti-tracking-reviewers

Comment 6

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/mozilla-central/rev/4c6f90c2cac0
https://hg.mozilla.org/mozilla-central/rev/68549f95ad04