362570 - Better UI/options for people who want to downgrade most cookies to session cookies but allow some to persist

Status: RESOLVED WORKSFORME

(Firefox :: Settings UI, defect)

Description

[Robert Chapin]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1) Gecko/20061010 Firefox/2.0
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1) Gecko/20061010 Firefox/2.0

atm, my favorite IE feature is the ability to block all cookies by default.  FF2 cookie options are confusing and ineffective.

This is probably a duplicate.  If anyone knows where the cookie option gripes go, I would appreciate some guidance.  :)

Reproducible: Always

Comment 1

[Robert Chapin]

To clarify:  I'm not looking for cookies on/off.  I'm looking for block by default, with exceptions and notifications.  Generally better times with cookie privacy.  I'm the kind of guy who wants to keep cookies for Google and ignore everyone else :)

Comment 2

[Daniel Veditz [:dveditz]]

You can, in fact, do what you want. I guess the Options UI isn't as clear as it could be.

Uncheck the "Accept cookies from sites" box: defaults to blocking cookies.

Click the Exceptions button and add sites you want to receive cookies from anyway.

Or, for 'notification' leave "accept cookies" checked and then set the combo-box to "ask every time". From that dialog you can block or allow each site.

"works for me"?

Comment 3

[Robert Chapin]

I guess I need to clarify again.  In IE it is possible to automatically accept all session cookies (required by many sites) and reject all persisting cookies.  Thus, exceptions will apply to persisting cookies.  This is my favorite cookie policy.  For picky users, it is also possible to set different policies for direct cookies and 3rd-party cookies.

The FF options (if I understand them now, they are very confusing) can at best set all cookies to expire when the browser closes.  But then any desirable persisting cookies are lost.  That would cause a lot of unnecessary logins.

And btw, "Keep until: Ask me every time" doesn't make any sense :P

Comment 4

[Robert Chapin]

Also, sometimes I delete specific cookies.  In FF2, if I do that, I later find out that the browser is blocking the new cookies I am trying to save.  I find that incredibly strange.

Comment 5

[Robert Chapin]

Notification ideas are in bug #217199

Comment 6

[Daniel Veditz [:dveditz]]

(In reply to comment #3)
> I guess I need to clarify again.  In IE it is possible to automatically accept
> all session cookies (required by many sites) and reject all persisting cookies.

You can do this setting the hidden pref network.cookie.alwaysAcceptSessionCookies to true. I don't know why the option was removed from the UI so I'm going to confirm this as a "we need better UI" bug. We also caught a lot of flack for removing the UI for the 3rd party cookies, but that option also still exists as a now-hidden pref.

> The FF options (if I understand them now, they are very confusing) can at best
> set all cookies to expire when the browser closes.  But then any desirable
> persisting cookies are lost.  That would cause a lot of unnecessary logins.

You can set all cookies to expire at browser close, but if you add any sites to the "Allow" list that will override the global setting and those sites will be able to set persistent cookies. It is not at all clear --> again confirming the "need better UI" request.

(In reply to comment #4)
> Also, sometimes I delete specific cookies.  In FF2, if I do that, I later find
> out that the browser is blocking the new cookies I am trying to save.  I find
> that incredibly strange.

Hm, it used to be an option that when you deleted a cookie you could mark a check box to keep that cookie blocked in the future. We've removed the UI for the option, do we go ahead and do it anyway? Yuck.

Comment 7

[Thorin [:thorin]]

how about a little love for this privacy key-worded ticket after 15 years ... I can't remember was the interface was 15 years ago .. its a WORKSFORME going by today :)

about:preferences#privacy > Cookies and Site Data

• [ ] Delete cookies and site data when Firefox is closed [Manage Exceptions]

Note: network.cookie.lifetimePolicy will be deprecated (soon - Bug 1681493) but the above UI and functionality will not be affected

Users can also block all cookies by default if they really wanted to (cookieBehavior) and regardless of that pref, users can always use Ctrl-I

+1 closing .. pinging Johann

Comment 8

[Thorin [:thorin]]

clearing johann, but this, AFAICT, is a dead ticket

Comment 9

[Thorin [:thorin]]

Paul, another dead ticket?

Comment 10

[Emma Zühlcke [:emz]]

301 to Hannah :-)

Comment 11

[Hannah Peuckmann]

I agree with Simon Mainey, cleaning on shutdown seems sufficient to me as well. Under the History settings one can also choose only the cookies checkbox, if the user wants to keep the site data part of the clear cookies and site data option. I think additional UI options for session cookies and cookie blocking would bring more complexity to a UI that is looking to become simpler and more intuitive (e.g. Bug 1765533).