1949016 - Google signs me out every time I close firefox or after ~24 hours

Status: UNCONFIRMED

(Core :: Privacy: Anti-Tracking, defect)

Description

[Loreno Heer]

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:135.0) Gecko/20100101 Firefox/135.0

Steps to reproduce:

I have cookie and tracker settings to strict, first-party isolation and also use ublock origin.

Actual results:

Lately google keeps signing me out and I have to sign back in. I suspect it has something to do with the privacy.purge_trackers.enabled preference. In another computer where this property is set to false, I am not being signed out.

Expected results:

I think some suspected tracking cookies are accidentally being deleted even though those are the cookies used for the google sign in.

Comment 1

[Tim Huang[:timhuang]]

Hi Loreno, could you share your troubleshooting info with us? You can find it in the about:support page.

Comment 2

[Loreno Heer]

Attachment: about:support raw output

Comment 3

[Emma Zühlcke [:emz]]

Thanks for the report. Two things:

First party isolation is not supported in Firefox. Could you try setting privacy.firstparty.isolate to false, clear all site data for Google and see if the error still reproduces?

I'm also curious if this could be caused by our new bounce tracking protection feature which is enabled in ETP "strict". To find out it would be helpful if you could run a code snippet for me in the Browser Toolbox:

1. Follow these instructions on how to enable and open the browser toolbox: https://firefox-source-docs.mozilla.org/devtools-user/browser_toolbox/index.html#enabling-the-browser-toolbox
2. Once open in the console tab of the browser toolbox run the following code:
   (Please only run code from sources you trust in this toolbox because it can expose sensitive data or break your profile if you're not careful.)

(() => {
  let btp = Cc["@mozilla.org/bounce-tracking-protection;1"].getService(
    Ci.nsIBounceTrackingProtection
  );

  let recentlyPurged = btp.testGetRecentlyPurgedTrackers({}).map((tracker) => ({
    siteHost: tracker.siteHost,
    purgeTime: new Date(Math.floor(tracker.purgeTime / 1000))
  }));
  
  let recentlyClassified = btp.testGetBounceTrackerCandidateHosts({}).map((tracker) => ({
    siteHost: tracker.siteHost,
    classifiedTime: new Date(Math.floor(tracker.timeStamp / 1000))
  }));

  console.debug("recently classified", JSON.stringify(recentlyClassified, null, 2));
  console.debug("recently purged", JSON.stringify(recentlyPurged, null, 2));
})();

3. Please share the output of the code here (recently classified, recently purged).

If we see google domains in that output it could indicate that BTP is causing this issue.

Comment 4

[Loreno Heer]

(() => {
let btp = Cc["@mozilla.org/bounce-tracking-protection;1"].getService(
Ci.nsIBounceTrackingProtection
);
…
recently classified [] debugger eval code:16:11
recently purged [
{
"siteHost": "google.com",
"purgeTime": "2025-02-19T19:55:08.185Z"
},
{
"siteHost": "data-medics.com",
"purgeTime": "2025-02-19T20:55:08.187Z"
}
] debugger eval code:17:11
undefined

I ran it a few times when google was still logged in, and the result was always empty. As soon as I noticed that I have been logged out, I ran it again and got this result above.

Comment 5

[Emma Zühlcke [:emz]]

Thank you! "google.com" being purged is suspicious and may have led to the logout. It's surprising this would only happen every 24 hours and on shutdown though.

(1) Let's check why "google.com" was purged. It should have only been purged if you didn't recently (45 days) interact with it.
Can you run the following snippet and check if you see any Google related domains that stand out?

(() => {
  let btp = Cc["@mozilla.org/bounce-tracking-protection;1"].getService(
    Ci.nsIBounceTrackingProtection
  );

  let recentlyInteracted = btp.testGetUserActivationHosts({}).map((site) => ({
    siteHost: site.siteHost,
    interactionTime: new Date(Math.floor(site.timeStamp / 1000))
  }));

  let recentlyInteractedGoogle = recentlyInteracted.filter(({
    siteHost
  }) => siteHost.includes("google"));

  console.debug("recently interacted", JSON.stringify(recentlyInteracted, null, 2));
  console.debug("recently interacted google", JSON.stringify(recentlyInteractedGoogle, null, 2));
})();

recentlyInteracted may contain more google domains that are not captured by my very crude "google" filter. Let me know if anything stands out. You don't have to share the entire list since that would expose a lot of your browsing history.

(2) How do you log into Google? Can you give me a list of steps I could follow to see if I can reproduce your issue? Do you log in through some country specific Google domain, e.g. google.de?

Thanks so much for helping with the troubleshooting!

Comment 6

[Loreno Heer]

This is odd. The first code you sent still returns

recently classified [] debugger eval code:16:11
recently purged [
  {
    "siteHost": "google.com",
    "purgeTime": "2025-02-24T08:30:07.030Z"
  }
]

however the second code does not return anything:

recently interacted [] debugger eval code:15:11
recently interacted google [] debugger eval code:16:11
undefined 

I use the regular google.com and gmail.com domains to sign in.

Comment 7

[Emma Zühlcke [:emz]]

Sorry, just getting back to this now. Thanks for providing the data! It seems odd that "google.com" gets purged and there are no interactions with other Google domains. AFAIC the Google sign in page uses "accounts.google.com" which means you should have interaction for at least "google.com".

Let's look at this from another angle. Can I ask you to enable Bounce Tracking Protection logging, wait until the issue appears again and post the log here? If it contains more data than you'd like to share here you can either remove unrelated sites from the log, or send me the log via e-mail: [e-mail]

Here is how you can record a log file:

1. Enter the following address in the address bar: about:logging?output=profiler&modules=BounceTrackingProtection:5&output=file
2. Select a log file destination and confirm with "set log file"
3. Click "start logging" at the top of the page
4. When you're done (you've reproduced the issue) click "stop logging"
5. Share the generated log file

Thanks again for your help!