250931 - thunderbird enables cookies by default

Status: RESOLVED DUPLICATE of bug 275131

(Thunderbird :: General, defect)

Description

[[e-mail]]

since cookies moved into necko, thunderbird is forced to carry around the cookie
backend (given that there's no --disable-cookies option, which imo is a good
thing, gre-wise).

afaict, the cookie pref in thunderbird is the default (enabled), and there is no
thunderbird-specific nsICookiePermission impl - thus, cookies will be enabled by
default. i don't think this is what mscott intended ;)

two possible fixes here:
(a) change the default cookie pref in tb to be disabled by default.
(b) implement nsICookiePermission specific to tb, to reject all cookies.

i prefer (b) since it guarantees that every cookie will be blanket-rejected.
doing only (a) would still allow users to enable cookies by toggling the pref
(but maybe that's desirable?).

Comment 1

[Scott MacGregor]

Thanks for bringing this up dwitte. You are right this i not what I intended.
yuck when did cookies become a requirement? I wish I was consulted when this
decision was made.

I do not want to pay any footprint overhead for cookies please.  Please add a
disable cookies option if you are going to leave it necko instead of extensions. 

There is no GRE right now shipping to our primary customers. There is a
Thunderbird product that is going to end users with a 1.0 release date very
soon. That is more important.

Comment 2

[[e-mail]]

well... to answer your first question, darin mailed you about it before we
effected the move. the mail was dated 8/14/03, and you responded that you'd like
to see a --disable-cookies build option, since the GRE was likely some way off.
darin subsequently filed a bug on that... bug 221885.

so, we can give that bug some love, if you'd like... which would make this bug
redundant, for now. we'll still need to fix this for when we do have a GRE.
so... what are your thoughts on this bug? would you like it fixed now, so when
we do switch the GRE on, it's not a problem again? which solution in comment 0
do you prefer?

Comment 3

[[e-mail]]

Attachment: use --disable-cookies

now that bug 221885 has landed, we can disable cookies for thunderbird, until
it comes time to be GRE-friendly...

Comment 4

[[e-mail]]

Comment on attachment 153629 [details] [diff] [review]
use --disable-cookies

bienvenu, care to r+sr this instead of mscott?

Comment 5

[[e-mail]]

Comment on attachment 153629 [details] [diff] [review]
use --disable-cookies

trivial build fix for tbird - we really don't want it to accept cookies, right?
;)

Comment 6

[[e-mail]]

Comment on attachment 153629 [details] [diff] [review]
use --disable-cookies

a=bienvenu over aim.

Comment 7

[Scott MacGregor]

please don't check this into the aviary branch.

We are closed until firefox 1.0 is released.

And now that we have RSS we need cookies for loading messages in the message
pane for RSS so I'm not sure that we want this right now...

Comment 8

[J Luh]

Mozilla Mail/News has a "network.cookie.disableCookieForMailNews" pref. Could
this be used in Thunderbird to block cookies for mail and news but allow them
for RSS?

http://lxr.mozilla.org/seamonkey/source/extensions/cookie/nsCookiePermission.cpp#79

Comment 9

[Michiel van Leeuwen (email: mvl+moz@)]

No, because the window that makes the request is still a mailnews window

Comment 10

[ppmm]

I found thunderbird 1.0 disables cookie in the RSS reading pane by default. I
think it makes sense though but I didn't find how to enable it in the UI...

Comment 11

[blujay]

We need a way to enable cookies in Tb.  As stupid as it is, some sites won't
display without the browser accepting cookies, and this makes some RSS feeds
unusable.

Frankly, I don't think disabling them completely from 1.0RC to 1.0 was a wise
decision, especially with no warning!  Make it an option, or at least SAY you're
doing it in the release notes.

Comment 12

[Scott MacGregor]

See Bug #275131 where I'm working on a Thunderbird specific cookie policy
permission object which will allow cookies for RSS and deny them for everything
else....

Comment 13

[[e-mail]]

all taken care off c/o mscott in bug 275131.

*** This bug has been marked as a duplicate of 275131 ***