333999 - Cookie manager exceptions misleading.

Status: RESOLVED INVALID

(Firefox :: Security, defect)

Description

[Mario Grgic]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.2) Gecko/20060308 Firefox/1.5.0.2
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.2) Gecko/20060308 Firefox/1.5.0.2

This is on Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.2) Gecko/20060308 Firefox/1.5.0.2

In my cookie preferences I have decided to allow sites to set cookies and only originating sites. In my exceptions I have blocked all cookies that match *doubleclick* pattern. 

When I visit www.cbc.ca I get a cookie from doubleclick. (Yes, they may use IFrame or redirect trick or whatever). But my understanding of cookie exceptions   it seems is wrong. I though that if I said "Block *doubleclick*", it meant block the damn cookie from *doubleclick* no matter how it attempts to get on my computer, even if I visit www.doubleclick.com from address bar, their cookies should still be blocked, because of my exceptions setting.

If my understanding of this is wrong, then you should really provide the users with the ability to do what I want to do, and rename the misleading "Exceptions" feature to something more appropriate.

Reproducible: Always

Comment 1

[Daniel Veditz [:dveditz]]

The exceptions list does not support regular exceptions, just domain names.  It will block sub-domains of the listed domains which maybe seems like wildcard behavior, but it's just the way domains work.

Comment 2

[Daniel Veditz [:dveditz]]

wildcards would be nice but would slow things down: the entire list would have to be checked for each cookie, we couldn't do an efficient search for the correct term.