Subdomain cookies not blocked or deleted correctly |
||||||
Issue descriptionA specific combination of Cookie blocking and session-only cookie rules doesn't work correctly As reported by user in https://crbug.com/777718 : 1. Set global cookie setting to "blocked" (also "block 3rd party data") 2. Add the following to the "session only" list: [*.]www.hafjell.no 3. Visit the site, exit browser, restart and verify If you add the following to the "session only" list: [*].hafjell.no (in addition to the previous entry) - the cookie will no longer survive restart. The cookie that is set and survives restart is for hafjell.no. There are several cookies for www.hafjell.no that do not survive restart with either rule. It would appear that permitting www.hafjell.no somehow allows cookies to be set for hafjell.no as well, but then on exit does not clear them (inconsistently applied filter?)
,
Nov 13 2017
The surviving cookie is for ".hafjell.no". This cookie applies to all subdomains of hafjell.no and hafjell.no itself. It looks like the blocking and deletion behavior is applied inconsistently. The cookie is allowed to be created but it is not deleted on shutdown. We need to figure out what is the desired behavior.
,
Nov 13 2017
,
Nov 13 2017
> Add the following to the "session only" list: [*.]www.hafjell.no This could be a problem. Session only cookies only last as long as the Chrome process is alive. If the process is closed, then the cookies are gone (they live in memory). To verify this is an actual problem, I would set the cookies with an expiry date and then close the browser.
,
Nov 22 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/369b5757b2a1b94c89dda2cb10576bd4026544d8 commit 369b5757b2a1b94c89dda2cb10576bd4026544d8 Author: Christian Dullweber <dullweber@chromium.org> Date: Wed Nov 22 16:12:38 2017 Fix cookie deletion If all cookies are blocked but there is a SESSION_ONLY rule for www.example.com, a cookie for .example.com could be created. It would not be deleted on shutdown because it doesn't match the SESSION_ONLY domain. A user would expect that this set of rules does not allow any cookies to be kept after restart. This CL changes session deletion to also remove cookies for domains that are BLOCKED if there is at least one SESSION_ONLY rule. Bug: 784312 Change-Id: I883e9657b7ab758075be4a416caf0596209489ae Reviewed-on: https://chromium-review.googlesource.com/766372 Reviewed-by: Martin Šrámek <msramek@chromium.org> Reviewed-by: Jochen Eisinger <jochen@chromium.org> Commit-Queue: Christian Dullweber <dullweber@chromium.org> Cr-Commit-Position: refs/heads/master@{#518647} [modify] https://crrev.com/369b5757b2a1b94c89dda2cb10576bd4026544d8/chrome/browser/extensions/extension_special_storage_policy.cc [modify] https://crrev.com/369b5757b2a1b94c89dda2cb10576bd4026544d8/chrome/browser/extensions/extension_special_storage_policy.h [modify] https://crrev.com/369b5757b2a1b94c89dda2cb10576bd4026544d8/chrome/browser/extensions/mock_extension_special_storage_policy.cc [modify] https://crrev.com/369b5757b2a1b94c89dda2cb10576bd4026544d8/chrome/browser/extensions/mock_extension_special_storage_policy.h [modify] https://crrev.com/369b5757b2a1b94c89dda2cb10576bd4026544d8/chrome/browser/sessions/better_session_restore_browsertest.cc [modify] https://crrev.com/369b5757b2a1b94c89dda2cb10576bd4026544d8/chrome/browser/sessions/session_data_deleter.cc [add] https://crrev.com/369b5757b2a1b94c89dda2cb10576bd4026544d8/chrome/test/data/session_restore/subdomain_cookies.html [modify] https://crrev.com/369b5757b2a1b94c89dda2cb10576bd4026544d8/components/content_settings/core/browser/cookie_settings.cc [modify] https://crrev.com/369b5757b2a1b94c89dda2cb10576bd4026544d8/components/content_settings/core/browser/cookie_settings.h [modify] https://crrev.com/369b5757b2a1b94c89dda2cb10576bd4026544d8/content/browser/net/quota_policy_cookie_store.cc [modify] https://crrev.com/369b5757b2a1b94c89dda2cb10576bd4026544d8/extensions/shell/browser/shell_special_storage_policy.cc [modify] https://crrev.com/369b5757b2a1b94c89dda2cb10576bd4026544d8/extensions/shell/browser/shell_special_storage_policy.h [modify] https://crrev.com/369b5757b2a1b94c89dda2cb10576bd4026544d8/storage/browser/quota/special_storage_policy.h [modify] https://crrev.com/369b5757b2a1b94c89dda2cb10576bd4026544d8/storage/browser/test/mock_special_storage_policy.cc [modify] https://crrev.com/369b5757b2a1b94c89dda2cb10576bd4026544d8/storage/browser/test/mock_special_storage_policy.h
,
Nov 27 2017
Issue 775080 has been merged into this issue.
,
Nov 27 2017
,
Nov 27 2017
,
Dec 13 2017
Doesn't look fixed chromium-63.0.3239.84-127.1.x86_64
,
Dec 13 2017
The fix is currently in Canary and Dev channels (>= 64.0.3276.0) Chrome 64 will be stable in about 6 weeks.
,
Mar 3 2018
Still an issue in chromium-64.0.3282.167-141.1.x86_64 Tested with https://mobile.twitter.com:443 set in "Clear on exit". Upon restart the cookies are still there in chrome://settings/siteData
,
Mar 5 2018
|
||||||
►
Sign in to add a comment |
||||||
Comment 1 by dullweber@chromium.org
, Nov 13 2017Labels: -Pri-3 Pri-2