787304 - Disabling third party cookies causes View Page Source requests to not send any cookies

Status: UNCONFIRMED

(Core :: Networking: Cookies, defect, P5)

Description

[Donald Sarratt]

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:15.0) Gecko/20100101 Firefox/15.0
Build ID: 20120824154833

Steps to reproduce:

Disabled "Accept third-party cookies" in Privacy Settings.
Loaded a webpage that requires cookies (e.g. an account settings page).
Right-clicked on the page, selected "View Page Source".

Reproducible: Always


Actual results:

When Firefox sends a new request to get the page source, it does so WITHOUT sending any cookies, causing the incorrect page to be loaded.


Expected results:

The page should have been requested WITH the existing cookies.

Comment 1

[Donald Sarratt]

Testing shows this only happens if "Vary: Cookie" is in the HTTP headers of the requested page. If the Vary header does not include Cookie (or *), or if the Vary header is absent, Firefox performs as expected.

Comment 2

[web-mozilla]

I've found that if a cookie exception is in place in preferences to 'Allow' cookies from a specific domain, then the cookie is sent even if 'Allow third-party cookies' remains unchecked in privacy settings.

Example:
Third party cookies disallowed; no cookie exception in place for x.example.com

1) Login to x.example.com 
2) View source does not send any cookies to x.example.com
3) Add a privacy exception allowing cookies from x.example.com
4) View source now sends cookies to x.example.com and shows the correct page source

Comment 3

[xavier.combelle]

It also happen on firefox developper edition 37.0a2 (2015-02-12) under linux (debian wheezy)

Comment 4

[Alexia E. Smith]

I can confirm this happening as of the latest 42 alpha.  The View Source functionality is essentially useless if you value your privacy.  Previously before this was broken the View Source functionality would just show the previously downloaded source instead of reloading the page.  There should never be a need to resubmit the page request especially when that could result in POST'ing a form twice.

Comment 5

[Firefox Bug Husbandry Bot]

Bulk change to priority: https://bugzilla.mozilla.org/show_bug.cgi?id=1399258

Comment 7

[jschachter]

This is still a problem in Firefox 80+. I am unable to debug my application in Firefox, because my server only sends the source if the browser request includes a valid cookie indicating I am logged in.

Other browsers (Chrome, Safari...) all handle this properly. This cannot be rocket science. 8 months ago a bug that is 19 years old was marked as a duplicate of this one. Is this ever going to get fixed???

Comment 8

[jschachter]

bug 1149835 and bug 1654358 are likely related.