2019345 - User Allow list overrides company level blocklist, unblocking all blocked websites

Status: NEW

(Firefox Enterprise :: Console, defect)

Description

[lburuian]

Attachment: allowed website filter at user level overrides company level website filter.mov

Found in

• Firefox Enterprise 149.0a1 (2026-02-21)

Tested platforms

• Affected platforms: All

Preconditions

• Have a WebsiteFilter policy set up at the company level, blocking some websites.

{
  "Block": [
    "https://www.reddit.com/",
    "https://www.youtube.com/"
  ]
}

• Restart Enterprise and make sure the websites are blocked.

Steps to reproduce

1. At the user level, set up a WebsiteFilter policy to allow some other websites (different from the ones in the company policy).
2. Restart the Enterprise client for the changes to take effect.

Expected result

• The company blocked websites are still not accessible.

Actual result

• The company blocked websites are now accessible.

Additional notes

• This also occurs when, at user level you set up a WebsiteFilter policy to only allow some of the sites blocked by the company level policy.

Comment 1

[Julien Wajsberg [:julienw] (PTO -> Mar 16)]

hey Luminita,
can you please share what specific values you've set in both cases?
also I don't understand fully the Expected and Actual results, they read the same way to me.
Thank you!

Comment 2

[lburuian]

Hello Julien,
Thank you for looking in to this. I edited the Actual result, sorry about that.
This was set at at company level:

{
  "Block": [
    "https://www.reddit.com/",
    "https://www.youtube.com/"
  ]
}

This was set at user level:

{
  "Allow": [
    "https://www.reddit.com/",
  ]
}

We later noticed that no matter what websites we set as Allow at user level, all the company blocked websites get unblocked.

{
  "Allow": [
    "https://www.facebook.com/*",
    "https://facebook.com/*",
    "https://www.instagram.com/*",
    "https://instagram.com/*",
    "https://www.twitter.com/*",
    "https://twitter.com/*",
    "https://www.tiktok.com/*",
    "https://tiktok.com/*"
  ]
}

Arguably, by setting a custom policy at user level, you basically uncheck the inheritance, but we still feel this is not really clear and could create issue in policy setting.
Please let me know if I can be of more assistance.

Comment 3

[Julien Wajsberg [:julienw] (PTO -> Mar 16)]

Thank you, then I think this is the expected outcome: the policies are not merged, they are completely replaced. Once you set the policy at the user level, the policy at the company level does not exist anymore for this user.

I understand the confusion though, and that could be an improvement in how we handle policies in the future. Flagging Romain for the future roadmap, but I don't think this is a bug for Pilot.

Comment 4

[Romain Testard [:RT]]

Agreed it would be an improvement, not in scope for pilot.
Let's keep the bug opened and figure out how to address the legitimlate feedback in the policy UI or in the docs.