662485 - Clear history when Firefox closes: cookies, doesn't clear session cookies in Firefox 4+

Status: RESOLVED WORKSFORME

(Firefox :: General, defect)

Description

[ianp]

User-Agent:       Mozilla/5.0 (X11; Linux i686; rv:5.0) Gecko/20100101 Firefox/5.0
Build Identifier: Mozilla/5.0 (X11; Linux i686; rv:5.0) Gecko/20100101 Firefox/5.0

In Firefox 3.6.x, checking 'Cookies' inside 'Clear history when Firefox closes' does what it's supposed to do: clear browser cookies on Firefox exit.

Since Firefox 4, this preference no longer clears the locally cached browser cookies. Closing, then starting Firefox shows previously set cookies despite having the aforementioned preference enabled.

I have read that since Firefox 4, work has started on supporting clearing plugin cookies when the preference is set, e.g. Flash LSOs. But starting Firefox 4, this preference no longer clears browser cookies, at least in Linux.

Perhaps this might be a side-effect of the problems with the ongoing work on supporting cookie cleaning for plugins, unless I missed a change in policy concerning this preference.

Reproducible: Always

Steps to Reproduce:
1. Check 'Clear history when Firefox closes' inside Preferences -> Privacy.
2. Check 'Cookies' inside 'Clear history when Firefox closes' settings.
3. Close, then start Firefox.

Actual Results:  
The browser cookies that were supposed to be cleared are still present when viewing cookies.

Expected Results:  
The browser cookies should be cleared and viewing cookies should show up empty.

I do have the browser remember opened tabs when it exits. At the same time I have browser.sessionstore.max_concurrent_tabs set to 0. But even so, I have a blank tab selected when the browser restores its session, so viewing cookies should still show up empty, save for extensions that I have allowed to set cookies via exceptions.

Comment 1

[George Carstoiu]

Mozilla/5.0 (X11; Linux i686; rv:7.0a1) Gecko/20110607 Firefox/7.0a1

Performing the steps presented in Comment 0, I was unable to reproduce the issue you have logged - once Firefox was closed, all the cookies were erased.

Just to make sure, can you please try it on a clean profile:
http://support.mozilla.com/en-US/kb/Managing-profiles

Comment 2

[ianp]

My bad. I should have done testing too on a clean profile, but FWIW I built my Firefox 5.0 on a new profile - not an upgrade from 3.6.x nor 4.0.x.

But thanks to you reminding me that I was able to find some more subtle details on the matter.

I typically have four tabs open, plus another four apptabs providing quick access to the add-ons manager, about:config, and two extension-related tabs. On the four tabs I recycle between them opening different websites, often times reusing one tab for several websites.

Testing on a new profile, I found out that some websites I had left open in tabs were setting session cookies, despite not being loaded and focused upon session restore because of max_concurrent_tabs=0. This is different from the 3.6+BarTab (I don't use BarTab anymore starting Firefox 4, although I wish some aspects of it are carried over) combo I was using before, where even though websites are left in the tabs, no cookies were set, not even session cookies, save for some extension cookies, upon restarting the browser.

This subtle behavior from Firefox 4.0 onwards left cookies in the browser, which made me believe cookies were not being cleared.

Another subtle behavior I have observed is that because I reuse tabs for opening websites _without_ closing the tab and because of the aforementioned behavior, session cookies from websites loaded in the said tab persist after browser restart, even if the tab is set to the about: page before restarting the browser.

This further gave me the impression that cookies were not being cleared, even when the website to which the cookies belong was not left open in any tab. I would expect that given the subtle behaviors observed, website cookies that were no longer present in any of the tabs would at least be cleared.

To clear the cookies, I had to either manually clear all cookies, or close down the tabs and open a new set of tabs.

Clearing cookies when Firefox exits occurs normally if not restoring tabs.

Comment 3

[ianp]

To facilitate reproducing the issue, I'm outlining here updated steps to reproduce, actual results, and expected results.

Steps to Reproduce:
1. Create a new profile.
2. Select 'show my windows and tabs from last time' when Firefox starts in the options/prefs.
3. Check 'clear history when Firefox closes'. From its settings, check 'cookies'.
4. Open ebay.com, then open minitheatre.org in the same tab.
5. Check that cookies are set for ebay.com and minitheatre.org.
6. Then open about: in the same tab. Restart the browser _without_ closing the tab.


Actual Results:
Session cookies are left for ebay.com and minitheatre.org.

Expected Results:
Cookies should be cleared when Firefox exits.

Given that both ebay.com and minitheatre.org are not present in any restored tabs, cookies from them should be cleared.

Comment 4

[George Carstoiu]

Mozilla/5.0 (X11; Linux i686; rv:7.0a1) Gecko/20110620 Firefox/7.0a1

Confirming issue using the steps to reproduce from Comment 3. Some cookies are left in the Cookie manager despite the settings.

All the cookies are deleted only if the Browsing history option from the settings window is checked off.

Setting status to New.

Comment 5

[chilie1975]

Just confirming this exists, in both 5.0 and 8.0a1 (2011-08-12).

Steps as in 3 work. This is a fairly serious security breach as previous behavior was that quitting cleared all cookies. Expecting the same behavior, one could accidentally leave something logged.

(easier) steps to reproduce:
1. Select "Show my windows and tabs from last time"
2. Select "clear history when FF closes" and "cookies" in its settings.
3. Open any site that saves a cookie (especially noticeable on log-in sites, i.e. google)
4. Quit & reopen firefox

Actual result:
Cookies from sites open when quit, including any log-in's.

Expect result:
New cookies should exist, but not the ones from pre-quit. A previously logged in site should no longer be logged it.

Comment 6

[ianp]

Mozilla/5.0 (X11; Linux i686; rv:7.0.1) Gecko/20100101 Firefox/7.0.1

UPDATE:

It seems that my prior suspicions regarding the ongoing work on supporting clearing plugin cookies when "Clear cookies when Firefox exits" is enabled appears to have some bearing upon the issue, after some testing.

When Flash LSO clearing is specifically removed from Firefox's "Clear cookie" mechanism, via the add-on BetterPrivacy that handles Flash LSO clearing, then "Clear cookies when Firefox exits" works as it has been prior to Firefox 4+, and which makes Comment 3 a non-reproducible issue.

As soon as Flash LSO clearing is returned back to Firefox's built-in mechanism (either via disabling the add-on or unticking the add-on pref to "Prevent Firefox Flash LSO clearing"), then the same issue occurs as in Comment 3.

And if that is not enough to attract notice to this issue, then perhaps an undesirable hack, or exploit taking advantage of this bug should get this issue some traction?

Comment 7

[cmail]

In version 18.0.2 I cant even find the option to clear cookies on exit. Once upon a time the option was a simple selection among the configurable options. Then it became buried requiring a bit of sleuthing to locate. Now, it seems to be completely gone.
I have a dread FF is doing a Microsoft on me and increasingly it is serving its own purposes by lowering the security available to users.

Comment 8

[Biodark]

I am too affected by this and I run version 20...

Comment 9

[Lukas Blakk [:lsblakk] use ?needinfo]

This behaviour has been present since Firefox 4, not a FF23 release tracking bug.

Comment 10

[Biodark]

This bug can be closed, it is fixed as version 26.

Comment 11

[Wayne Mery (:wsmwk)]

WFM per comment 10