1932960 - Clearing cookies in private window does not work

Status: NEW

(Firefox :: Site Identity, defect, P3)

Description

[Jose Weiner]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:132.0) Gecko/20100101 Firefox/132.0

Steps to reproduce:

1. Visit www.reddit.com in a private window
2. Click a subreddit so the site shows you a previously visited link on the left
3. Clear cookies and site data under the lock icon
4. Refresh the page

Actual results:

Site cookies are not cleared, the previously visited subreddit(s) still appears on the left despite 'clearing' the cookies. Also the button to clear the cookies is no longer available.

Expected results:

Clearing the cookies in a private window should work exactly as it does in a regular instance, doing the same steps in a regular instance produces the expected results.

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Toolkit::Data Sanitization' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 2

[Harshit Sohaney [:hsohaney]]

Attachment: Profiler_calltree

Yep I can reproduce this. It's interesting because when following the call stack using the profiler, I can see the cleaner being called but the cookie seems to persist. Thanks for filing this! Adding it to the team's backlog.
I think this might be of a bit higher priority seeing that the data isn't clearing properly. What do you think paul?

Comment 3

[Harshit Sohaney [:hsohaney]]

Setting to P2 for now

Comment 4

[Emma Zühlcke [:emz]]

This is a known issue we've had in the backlog for a while. I think it's a dupe but I can't find the original bug right now. Clearing data for private browsing sessions currently isn't supported. To work around this you have to restart the PBM session fully or use the devtools. The clear UI option in the identity panel is actually targeting normal browsing currently which is why its behavior is so confusing.

Now that we are adding support for clearing by site + OriginAttributesPattern we could actually make this work though. We'd first have to make sure all site data related cleaners support the new OriginAttributesPattern argument. Once that's supported we can update the UI so it calls clearDataForSite with both the schemeless site of the current tab and an OriginAttributesPattern dictionary which matches the full OriginAttributes of the current tab. There its important that all, even default values are populated in the pattern so that we don't wildcard match some of the omitted attributes.

Bug 1926589 is for updating all the cleaners.

For now we could also hide the clear data option in PBM entirely. I'm surprised we don't already do this.