252161 - 3rd party cookies still stored in spite of "originating web site only" pref

Status: VERIFIED INVALID

(Firefox :: Settings UI, defect)

Description

[sairuh (rarely reading bugmail)]

couldn't find an existing bug on this after several queries: I've turned on the
pref for storing cookies from "originating web site only," but 3rd party cookies
are still being stored.

found using 2004-07-15-11-0.9 on fedora core 2, while running a variation of
this test:

http://testrunner.mozilla.org/test.cgi#972

recipe used:

1. make sure that about:blank is your home page.

2. in Prefs > Privacy > Cookies, clear out all the stored cookies.

3. now set the follow cookie prefs:
* enable cookies selected
* "for the orginating web site only" selected
* "accept cookies normally" selected

4. hit OK to save and dismiss prefs.

5. visit a site which serves cookies from its own and other sites: I visited
http://www.cnn.com

6. open Prefs > Privacy > Cookies > Stored Cookies dialog.

expected: should only see cookies from cnn.com in the listbox.

actual results: there are several cookies from other sites, like advertising.com
and atwola.com.

this seems buggy to me, but perhaps cnn.com is somehow working around firefox's
means of avoiding 3rd party cookies...?

Comment 1

[Mike Connor [:mconnor]]

cnn has content (i.e. ads) that are served from atwola.com, which is setting the
cookie, not cnn.com.  There's a lot of sneakier ways out there using iframes
etc, but this is completely legitimate (check page info to see what sites are
serving content).

Comment 2

[sairuh (rarely reading bugmail)]

oh, right! like how going to http://www.aol.com does a bunch of redirects, hence
all those cookies from other sites which I wasn't expecting.

vrfy'ing invalid.

Comment 3

[Mike Connor [:mconnor]]

sorry for bugspam, long-overdue mass reassign of ancient QA contact bugs,
filter on "beltznerLovesGoats" to get rid of this mass change