658556 - Site-specific preferences reports cookies but doesn't allow to manage them

Status: RESOLVED WONTFIX

(Firefox :: Settings UI, defect)

Description

[Jean-Yves Perrier [:teoli]]

Attachment: Incoherence between amount of cookies and the cookies manager

When using the new preferences pane (about:permissions), if I select some sites (not all but quite a few), it reports several cookies for them. When clicking Manage cookies... It opens the Cookies managers with the domain name as filter but no cookies are listed.

Step to reproduce
1) Visit www.geckozone.org to be sure to have cookies set
2) Go to about:preferences
3) Select www.geckozone.org, UI reports several cookies
4) Click on Manage cookies..., the Cookies Manager doesn't report any cookies.

Comment 1

[:Margaret Leibovic]

Attachment: filter mis-match

I'm looking into this now, and it seems to be a problem with the cookie manager filter. I'm also getting some strange filter results :/

Comment 2

[:Margaret Leibovic]

So what seems to be happening in my screenshot is that the filter is matching those cookies because the string "www.google.com" is in the content of the cookie. This doesn't seem very useful (and it's clearly confusing), but I don't think it's a major problem.

The main problem is that this cookie manager interface labels cookies set for www.foo.com as being set for foo.com, and the filter isn't matching that. I assume that if you were to edit the filter to "geckozone.org" you would be able to find two cookies that are listed as "geckzone.org" in the Site column, but show a "www.geckozone.org" host at the bottom of the window when you inspect them.

I think a temporary solution could be to special-case "www" sites in about:permissions, and strip the "www" for the filter text. However, we might also want to look into combining www.foo.com and foo.com into one site, but I would have to look into whether or not the permission manager treats those as different sites or the same site.

Comment 3

[Jean-Yves Perrier [:teoli]]

I confirm your second paragraph: if I looked for geckozone.org in the Cookies Manager I got 8 cookies, two have www.geckozone.org as there host.

I think there are two problems: one is what is displayed in the Cookies Manager launched from about:permissions (probably a second bug should be opened for that), and the second is what is displayed on the Permissions Manager under each site.

I'm not (yet?) convinced with your temporary solution. I've looked at the HTTP State Management standard: a cookie set for domain x.y is valid for x.y and for any site matching *.x.y (* replacing anything but .)

So a cookie for .geckozone.org (I have 6 of them) is valid for www.geckozone.org and listes.geckozone.org and forums.geckozone.org. But the cookie for www.geckozone.org do apply for www.geckozone.org only (there is no subdomain).

I think the display "2 cookies are set for this web site" is not accurate as there really are 8 cookies applying to www.geckozone.org.

Another possibility would be to have 2 lines for each site:
2 cookies are set for the www.geckozone.org site [Clear Cookies...] [Manage Cookies...]
6 cookies are set for all geckozone.org sites [Clear Cookies...] [Manage Cookies...]

Advantages: all cookies can be managed from the Permission Manager; infos about the scope of the cookies is accurate
Disadvantage: it is slightly more complex for the user to use (two lines, two different scopes for cookies, two more buttons).

Comment 4

[:Margaret Leibovic]

Attachment: patch to address count/filter problem

This patch makes it so that cookies www.foo.com and foo.com are combined in the cookie count, and the cookie manager dialog is opened with the foo.com password. I'm slightly worried that it is kind of a lie to combine these cookies in the count, but I also feel like consistency with the cookie manager is important to reduce user confusion.

I agree that it would be good to somehow indicate that cookies set for a base domain apply to domains as well, but I think that is something that would need UX work to hash out a design, so it would be nice to land an easier fix first.

Comment 5

[:Gavin Sharp [email: [e-mail]]]

Comment on attachment 534091 [details] [diff] [review]
patch to address count/filter problem

discussed this on IRC, sounds like this isn't quite right and we probably want to adjust the cookie manager instead.

Comment 9

[:Margaret Leibovic]

I'm not actively working on this right now, so un-assigning myself in case someone else wants to jump in.

Comment 11

[Dão Gottwald [:dao]]

about:permissions has been removed in bug 933917.