Isolate DOM Storage to first party domain (Tor 6564)

RESOLVED DUPLICATE of bug 1260931

Status

()

Core
DOM: Security
P2
major
RESOLVED DUPLICATE of bug 1260931
5 years ago
9 months ago

People

(Reporter: mayhemer, Assigned: timhuang)

Tracking

(Blocks: 1 bug, {privacy})

Trunk
privacy
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(e10s-)

Details

(Whiteboard: [tor][ETA 10/10][domsecurity-active], URL)

(Reporter)

Description

5 years ago
+++ This bug was initially created as a clone of Bug #536509 +++

http://scarybeastsecurity.blogspot.com/2009/12/bypassing-intent-of-blocking-third.html claims localStorage does not obey the third-party cookies pref.

After bug 536509 gets fixed, we need to update DOMStorageImpl::CacheStoragePermissions to work with the third-party flag as well.  (Currently we pass false so despite the 3th-party-session-only pref we still persist in multi-process).

My first idea:
- move the mThirdParty flag to DOMStorageBase (a base class for DOMStorageChild and DOMStorageImpl)
- carry it from DOMStorageChild to DOMStorageParent (PStorage at PStorage.ipdl, Init() event, SendInit and RecvInit methods in C++)
- DOMStorageParent sets the flag on its DOMStorageImpl and we are done

Comment 1

3 years ago
We have a patch that is not tied to any pref to isolate DOM storage to the first party URL bar domain (ie "double-key) it. This might be more complex than what you're talking about, but we went with this option to still enable third party DOM storage functionality without the associated cross-site tracking. We prefer this approach for all types of third party identifiers (cache, cookies, DOM storage, etc).

You can have a look at the patch at:
https://gitweb.torproject.org/tor-browser.git/commitdiff/fc3f828978e8ec2347055e276bd6281de72629a8

Let me know if that sounds like something that is worth pursuing instead of simply disabling DOM storage for third parties, or if this approach should have a separate bug and pref.
Whiteboard: [tor]

Comment 2

3 years ago
(In reply to Mike Perry from comment #1)
> You can have a look at the patch at:
> https://gitweb.torproject.org/tor-browser.git/commitdiff/
> fc3f828978e8ec2347055e276bd6281de72629a8

This link was invalidated due to the hash chain invalidation from the Mozilla git mirror switchover. Here's a working link:

https://gitweb.torproject.org/tor-browser.git/commitdiff/1b3c110a29ae11b50ce2bf56d5954773262e67c0
tracking-e10s: --- → +
Blocks: 997462
Status: NEW → RESOLVED
Last Resolved: 3 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 536509
Here's a link that tracks the latest version of the Tor Browser patch:
https://torpat.ch/6564
and here are the regression tests:
https://torpat.ch/13749
I'm reopening this bug, to track work on isolating DOM storage to the URL bar domain (the approach taken by Tor Browser). This approach can break fewer sites than simply banning third-party DOM storage altogether.
Status: RESOLVED → REOPENED
Resolution: DUPLICATE → ---
Summary: e10s: localStorage does not obey "third-party cookies" pref → Isolate DOM Storage to first party domain
bug 536509 seems sufficient for what we needed in e10s, so untracking for e10s
tracking-e10s: + → -

Updated

11 months ago
Priority: -- → P1

Updated

10 months ago
Assignee: nobody → tihuang

Updated

10 months ago
Whiteboard: [tor] → [tor][ETA 10/10]

Updated

9 months ago
Component: DOM → DOM: Security
Priority: P1 → P2
Whiteboard: [tor][ETA 10/10] → [tor][ETA 10/10][domsecurity-active]
Summary: Isolate DOM Storage to first party domain → Isolate DOM Storage to first party domain (Tor 6564)

Updated

9 months ago
Blocks: 1299996

Comment 7

9 months ago
LocalStorage respects origin attributes and bug 1260931 added first party domain to origin attributes, so it should alread be isolated by first party domain.  We also have a test for that in bug 1264567.  As for session storage, it is already isolated per tabs by design.

I think there's nothing to do in this bug, so I'm closing it.
Status: REOPENED → RESOLVED
Last Resolved: 3 years ago9 months ago
Resolution: --- → DUPLICATE
Duplicate of bug: 1260931
You need to log in before you can comment on or make changes to this bug.