998033 - Possible change in default third party cookie policy negatively affecting Firefox accounts based sync login

Status: VERIFIED INVALID

(Core :: Networking: Cookies, defect)

Description

[Chris Karlof [:ckarlof]]

Attachment: default Fx29 history settings.png

Login to FxA Sync uses a remotely hosted iframe embedded in about:accounts. The hosted iframe uses localStorage, and we recently added a warning to enable cookies if we detect that we can't use it. This warning is being triggered in Fx31, but not in Fx29. I suspect this is due to change in the default third party cookie policy in Fx31 (or possibly Fx30). See attached screenshots.

Longer term, we could re-architect FxA login to accommodate this policy, for the time being, it will break the FxA Sync user experience.

Comment 1

[Chris Karlof [:ckarlof]]

Attachment: default Fx31 history settings.png

Comment 2

[Chris Karlof [:ckarlof]]

FxA tracking issue: https://github.com/mozilla/fxa-content-server/issues/942

Comment 3

[Chris Karlof [:ckarlof]]

Lowering severity because the impact on FxA appears to be less severe than I originally thought. I understand this policy doesn't affect third-party localStorage -- only third party cookies (Bug 744466), correct? We can likely work around this change for now, but applying this policy to localStorage will affect FxA login.

Comment 4

[[:mmc] Monica Chew (no longer reading bugmail)]

The default third party cookie behavior in Nightly has not changed since bug 818340. Note that that bug changed default behavior in Nightly only.

http://mxr.mozilla.org/mozilla-central/source/browser/components/preferences/privacy.js#183

If the iframe behavior hasn't changed, then it's been broken in Nightly all along.

Comment 5

[Chris Karlof [:ckarlof]]

Thank you, I understand this better now.

Disabling cookies globally will disable localStorage as well, but domains whose cookies are blocked via the third party cookie policy will currently not have their localStorage blocked (until Bug 744466 is fixed).

It's unfortunate the third-party cookie policy applies to "about" pages, but we can work around this issue by moving our remaining usage of cookies to localStorage.

Comment 6

[James Bonacci [:jbonacci]]

OK.