891954 - Missing TabChild with SetCookieString

Status: RESOLVED FIXED

(Core :: Networking: Cookies, defect)

Description

[Tom S [:evilpie]]

Attachment: stacktrace

Comment 1

[Josh Matthews [:jdm]]

Jason, do we want to disable IPC security checks for desktop e10s?

Comment 2

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

(In reply to Josh Matthews [:jdm] from comment #1)
> Jason, do we want to disable IPC security checks for desktop e10s?

The general goal, security-wise, is that the security properties of B2G and e10s-Firefox should be approximately the same. So, I would expect that the same security checks should be used on all platforms. So, it would be good to know more about the cause of this issue before we do any wallpapering over it.

Comment 3

[Jason Duell]

The security property we provide with B2G necko IPC security checks is that we prevent different apps from meddling with each other's cookies/cache/etc.  If e10s desktop doesn't have any concept of different apps then I'm OK with disabling the checks there.

Comment 4

[Tom S [:evilpie]]

We can load all kind of different webpages in on content process, so I think this is probably different from B2G where one app owns one process? I will remove this check from the larch branch, because it triggers quite often while changing pages.

Comment 5

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

Attachment: necko patch

This patch disables the checks. We'd like to get this on trunk so that it's possible to use electrolysis by flipping a pref.

Comment 6

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

Attachment: necko patch v2

Jason suggested a better way of doing this by flipping the existing pref in desktop configurations.

Comment 7

[Jason Duell]

Comment on attachment 781293 [details] [diff] [review]
necko patch v2

Review of attachment 781293 [details] [diff] [review]:
-----------------------------------------------------------------

::: browser/app/profile/firefox.js
@@ +1274,5 @@
>  // The request URL of the GeoLocation backend.
>  pref("geo.wifi.uri", "https://www.googleapis.com/geolocation/v1/geolocate?key=%GOOGLE_API_KEY%");
> +
> +// These security checks only apply in b2g. We want to disable them on desktop
> +// so that electrolysis works.

change to 

 // Necko IPC security checks only needed for app isolation for cookies/cache/etc:
 // currently irrelevant for desktop e10s

Comment 8

[Jason Duell]

Comment on attachment 781293 [details] [diff] [review]
necko patch v2

Review of attachment 781293 [details] [diff] [review]:
-----------------------------------------------------------------

::: browser/app/profile/firefox.js
@@ +1275,5 @@
>  pref("geo.wifi.uri", "https://www.googleapis.com/geolocation/v1/geolocate?key=%GOOGLE_API_KEY%");
> +
> +// These security checks only apply in b2g. We want to disable them on desktop
> +// so that electrolysis works.
> +pref("network.disable.ipc.security", false);

Oh, and you want disable == "true" here :)

Comment 9

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/44b9c2407781

Comment 10

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/44b9c2407781