238646 - Accept dialog w/ "Allow for Session" button for session cookies

Status: RESOLVED WONTFIX

(Core :: Networking: Cookies, defect)

Description

[benc]

(This might be a known issue, but I did search bugzilla for dupes...)

I really like the new dialog box. I don't know what other browsers have, but
this is a great improvement!

I did notice the following:

The Allow/Deny dialogs have 4 buttons now:

[Hide/Show Details] [Allow for Session] [Deny] [Allow]

These show up for both session and non-session cookies.

It seems to me, for session cookies, you would want to show either:

[Deny] [Allow for Session]

or simply

[Deny] [Allow] (since the user sort of knows it is a session cookie already).

I leave the details to the UI-focused people.

Comment 1

[[e-mail]]

the problem with this is: with the 'remember this decision' checkbox, you can
whitelist the site to set unrestricted lifetime cookies ('allow') or whitelist
it to set cookies for the session only ('allow for session'). so although the
cookie the checkbox is _currently_ displaying may be for session or otherwise,
the buttons have an effect that can apply to all cookies from that site.

thoughts, mconnor?

Comment 2

[[e-mail]]

i'd note that dbaron raised the issue in another bug somewhere, that it's not
exactly clear what effect 'remember my decision' has in conjuction with 'allow
for session'. (i.e. a user who is pessimistic about mozilla's features, might
assume it has the same effect as 'allow', in terms of what gets white/blacklisted).

Comment 3

[benc]

fixed summary...

Yeah. The general behavior is that the check box affects settings in the 2nd
tab, and the other buttons affected the settings in the 1st tab of cookie manager.

The new interface intermingles them more. It seems more intuitive (it just made
sense to me), but perhaps less consistent (I have trouble explaining it in writing).

Comment 4

[[e-mail]]

well, if we're fixing the summary... ;)

Comment 5

[Mike Connor [:mconnor]]

*bangs head on table*  I guess I could have thought about that.  Just 
check "don't ask for session cookies" and I don't have a problem :)

remembering to Allow for Session means that you will limit any cookies for this 
site to the current session. dbaron's beef was with the checkbox, not the button

Comment 6

[Mike Connor [:mconnor]]

okay, I did actually think about this while expanding the prompts.  The problem
with not showing both buttons is that you can set site perms, and that means
both buttons should be shown.  Also, some people might just set perms based on
the site, without viewing details, and it wouldn't make sense if the details
were hidden, unless we change the text, and maybe hide the checkbox?

That's just getting ugly and complex.  This only really is a factor if someone
is not using the remember checkbox and they're browsing with show details on, so
they can see both would effectively do the same thing.  I think that its few
enough users in that scenario that it'll be better to not do silly things with
the dialogs.

Comment 7

[Mike Connor [:mconnor]]

after thinking about this some more, marking this WONTFIX.  Any UI tweaking
would  not allow setting site perms, which would be inconsistent and confusing
to users.  While I agree that its imperfect, it's trivial enough that I don't
believe there is a better way to present this.  If someone thinks up something
that addresses the points already made, please reopen this bug.