1928873 - Storage Access API User Interaction Requirement

Status: RESOLVED INVALID

(Core :: Privacy: Anti-Tracking, defect)

Description

[Philipp Baus]

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:131.0) Gecko/20100101 Firefox/131.0

Steps to reproduce:

I tested the Storage Access API behavior on https://storage-access-api-demo.glitch.me/ and https://storage-access-api-demo-site-b.glitch.me/.

Actual results:

I set a cookie on the first page and visited the second page right after. The second page contains an frame which is same-origin to the first page. It requests storage access when clicking a button inside the frame in order to access the previously set cookie. Once I clicked the button this access was automatically granted as it should be. However, once I reloaded the page, the same iframe was able to request storage access again immediately after the site finished loading without any user interaction happening beforehand.

Expected results:

According to the most recent Mozilla Hacks article about the Storage Access API (https://hacks.mozilla.org/2022/02/improving-the-storage-access-api-in-firefox/) this behavior should not be the case:

"One of the changes has to do with the case of giving a third party storage access on a page, but then the page is reloaded. Does the third party have to get a user interaction before requesting storage access again? Initially, the answer was no, but now it is yes. We updated our implementation to reflect that change and align with other browsers."

Is this a bug or was it changed again after this article?

Comment 1

[BugBot [:suhaib / :marco]]

The Bugbug bot thinks this bug should belong to the 'Core::Privacy: Anti-Tracking' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 2

[Emma Zühlcke [:emz]]

I believe the behavior you're describing the is the correct one. If a site previously was granted storage access it does not need user activation after a reload anymore to request the access again. But I'll NI the Storage Access API expert to confirm. :-)

Sorry that we haven't looked at this bug sooner!

Comment 3

[Benjamin VanderSloot [:bvandersloot]]

This is intended, and in spec! This was changed after that article was written.

Comment 4

[Emma Zühlcke [:emz]]

Thanks! Maybe we should add a hint in that article that things have since changed.