1960824 - Revisit sameSite=none requires secure

Status: RESOLVED FIXED

(Core :: Networking: Cookies, defect, P2)

Description

[Andrea Marchesini [:baku]]

This feature is not correctly implemented because of:

• how we set the sameSite default value
• how we check the cookie sameSite attribute for none-requires-secure

I suggest disabling this feature, fixing the issue, and testing it nightly for a few cycles.

Comment 1

[Andrea Marchesini [:baku]]

Attachment: Bug 1960824 - Fix and disable "sameSite=none requires secure", r?edgul

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/84c0fce4a156
Fix and disable "sameSite=none requires secure" in !nightly, r=edgul,cookie-reviewers

Comment 3

[Pulsebot]

Backout by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/6e2e24c9d89b
Backed out changeset 84c0fce4a156 for causing multiple failures. CLOSED TREE

Comment 4

[Cristina Horotan [:chorotan]]

Backed out for causing multiple failures

Backout link

Push with failures

A few failure logs:
Failure log GTest
Failure log Xpc
Failure log xpc
Failure log bc
Failure log gv-junit
Failure log dt
Failure log wpt

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/6b47faf8efee
Fix and disable "sameSite=none requires secure", r=edgul,cookie-reviewers,valentin

Comment 6

[agoloman]

Backed out for causing dt failures @browser_webconsole_warning_group_cookies.js

• Backout link
• Push with failures
• Failure Log

Comment 7

[Andrea Marchesini [:baku]]

Attachment: Bug 1960824 - Introduce nsICookie::SAMESITE_UNSET, r?edgul

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/d01a1a055fec
Introduce nsICookie::SAMESITE_UNSET, r=edgul,webdriver-reviewers,extension-reviewers,cookie-reviewers,valentin,Sasha,robwu

Comment 9

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/d01a1a055fec