252902 - make cookie handling smarter by defaulting to session cookies

Status: RESOLVED INVALID

(Firefox :: General, enhancement)

Description

[Noam Tamim]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7) Gecko/20040614 Firefox/0.9
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7) Gecko/20040614 Firefox/0.9

I want a different cookie acceptance policy: I want to accept cookies from all
sites as "session" cookies, except for regular sites that I trust (web-mail,
google, mozilla, etc.), which I'd like to allow long-term cookies as well. 
This can be implemented by a simple white-list mechanism: any site not on the
list will have its cookies deleted when I leave it. As simple as that.
One more thing: add a "privacy" component to bugzilla.

Reproducible: Always
Steps to Reproduce:
1.
2.
3.

Comment 1

[[e-mail]]

you can already do this. set your cookie acceptance policy to "session only" and
whitelist the desired sites under "exceptions".

Comment 2

[Jesse Ruderman]

Filed bug 252938 for making this feature more discoverable.

Comment 3

[Noam Tamim]

(In reply to comment #1)
> you can already do this. set your cookie acceptance policy to "session only" and
> whitelist the desired sites under "exceptions".

You right, I can. But you know what is REALLY missing? Pattern domains. I want
to allow cookies from all yahoo.com sites, yet I cannot put "*.yahoo.com" in the
whitelist (actually I can, but it matches nothing). How is it related? I tried
your suggestion, adding yahoo.com and mail.yahoo.com to the whitelist, but
didn't know I also have to add login.yahoo.com, to make sure my username is saved.
If you end up implementing this feature, please bare in mind that "*.domain.tld"
should also match "domain.tld" - so it's more that just simple glob.
Should I file another bug report for this feature?

Comment 4

[Michiel van Leeuwen (email: mvl+moz@)]

if you whitelist yahoo.com, all subdomains are also whitelisted. No need to add
*.yahoo.com or something.

Comment 5

[Mike Connor [:mconnor]]

resolving INVALID.  This functionality already exists, how discoverable we've
made it is Jesse's bug.