2026913 - Remove nameless cookies (put them behind pref)

Status: RESOLVED FIXED

(Core :: Networking: Cookies, task, P2)

Description

[Valentin Gosu [:valentin]]

Nameless cookies have been a significant issue recently.
They are an odd edge case. Cookies like "abc" are parsed as {name: "", value: "abc" } by Firefox and Chrome. While Safari parses them as {name: "abc", value: "" }
The idea was that Firefox would mirror the nameless cookie back to the server in the same format (without an equal sign), and the server would handle it according to it's parser - as a nameless cookie, or as a valueless cookie.
However, if we have multiple nameless cookies, that entire plan breaks down. "abc; def" will result in two cookies being sent from Safari, but only one in Firefox and Chrome (as the second cookie overwrites the first one).

Also see bug 1964767 comment 3:

? From Squarcina's "Cookie Crumbles" https://www.usenix.org/system/files/usenixsecurity23-squarcina.pdf#page=10, from page 10, there's a table about analyzing nameless cookies in top 100K websites. From that analysis, nameless cookies are very rare and seem like a configuration mistake almost always (TOP 4: nameless cookies with the values HttpOnly, (empty string), Secure and =).

I think we should get rid of nameless cookies. I plan to put it behind a pref.

Comment 1

[Valentin Gosu [:valentin]]

Attachment: Bug 2026913 - Remove nameless cookies (put them behind pref) r=baku,dveditz

Comment 2

[Valentin Gosu [:valentin]]

Attachment: Bug 2026913 - update tests that mistakenly used nameless cookies r=baku

Comment 3

[Valentin Gosu [:valentin]]

Attachment: Bug 2026913 - Clean up nameless cookies from DB r=baku

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/25000f9ecb6f
https://hg.mozilla.org/integration/autoland/rev/6552c1275521
Remove nameless cookies (put them behind pref) r=baku,dveditz,cookie-reviewers,extension-reviewers,Sasha,robwu
https://github.com/mozilla-firefox/firefox/commit/7a45ba52365e
https://hg.mozilla.org/integration/autoland/rev/9b08fb675c7e
update tests that mistakenly used nameless cookies r=baku,manuel
https://github.com/mozilla-firefox/firefox/commit/991fe75b38e2
https://hg.mozilla.org/integration/autoland/rev/01a837103137
Clean up nameless cookies from DB r=baku,cookie-reviewers

Comment 5

[Serban Stanca [:SerbanS]]

https://hg.mozilla.org/mozilla-central/rev/6552c1275521
https://hg.mozilla.org/mozilla-central/rev/9b08fb675c7e
https://hg.mozilla.org/mozilla-central/rev/01a837103137