Requests which set LOAD_DO_NOT_SAVE_COOKIES are incompatible with Channel ID |
|||||
Issue descriptionIf either LOAD_DO_NOT_SAVE_COOKIES, LOAD_DO_NOT_SEND_COOKIES, or 3rd-party cookie blocking is enabled, HTTP requests will be forced through the "privacy mode" socket pool. This is done at https://cs.chromium.org/chromium/src/net/url_request/url_request_http_job.cc?rcl=7fe06f0c134410166e13a5b27b0401d42a83a7b7&l=353 If Privacy Mode is enabled, Channel ID is disabled. This is done at https://cs.chromium.org/chromium/src/net/http/http_network_session.cc?rcl=7fe06f0c134410166e13a5b27b0401d42a83a7b7&l=422 For requests that set LOAD_DO_NOT_SAVE_COOKIES, with the intent to send cookies but not save them (e.g. for personalization purposes), these will be sent over sockets that do not include the channel ID that the cookie is bound to. If the server is configured to reject bound cookies that aren't accompanied by their channel ID (as unauthorized/hijacked), then these cookies are rejected, making them pointless to send. This is simply one symptom/bug resulting from the overall inconsistency described in https://docs.google.com/document/d/1ntn9N7Ce2jozvvpWI0XbzJ7lJdwUjJXK07wp7rxrIN4/edit , which also discusses proposals for how to address this. There is no 'easy' fix, satisfying the case of (Send existing cookies, send existing Channel IDs) would require a new dimension of socket pools - either within the network stack itself (challenging due to late binding) or through additional URLRequestContexts for this purpose. This is not an issue for Token Binding, the successor to Channel ID. This is because the creation-or-binding of the Token Binding key is done at request time, rather than at socket connect time, allowing for requests to have this permutation. However, there is no timeline scheduled for the transition from Channel ID keys to Token Binding, or their migration for existing cookies.
,
Dec 6 2017
I agree that it's a desirable endstate to just have those two states, but the doc captures the motivation for the current send-but-not-save behaviour ("User Expectations"), and discussions are still ongoing about whether that motivating use case is still appropriate, given user perception.
The doc is trying to follow-up with all the service owners in this case to figure out whether (always on) and (always off) is sufficient for their needs, to continue to inform the discussion with Chrome Privacy.
,
Dec 6 2017
,
Dec 19 2017
+Privacy, FYI.
,
Jan 8 2018
,
Sep 5
,
Sep 5
Given that we're deprecating and removing Channel ID (crbug.com/875053), I don't think we need to take action on this bug. |
|||||
►
Sign in to add a comment |
|||||
Comment 1 by pkasting@chromium.org
, Dec 6 2017