New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 834699 link

Starred by 1 user

Issue metadata

Status: Untriaged
Owner: ----
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 3
Type: Bug



Sign in to add a comment

chrome.cookies.remove does not account for paths and host-only cookies

Project Member Reported by rob@robwu.nl, Apr 19 2018

Issue description

The chrome.cookies.remove API "Deletes a cookie by name".
https://developer.chrome.com/extensions/cookies#method-remove

The method only accepts {url,name}, and assumes that at most one cookie is removed.
This assumption is false, to uniquely identify a cookie the following is needed too:
- domain
- host-only
- path

(for "unique cookie" definition, see https://github.com/httpwg/http-extensions/issues/199 )

When an extension invokes chrome.cookies.remove, it may inadvertently remove more than one cookie.
This does not occur very often, and none of the extensions that I analyzed accounted for this non-uniqueness (see section 4 of https://bugzilla.mozilla.org/show_bug.cgi?id=1387957#c9).

So it would be safe (and closer with the expected behavior of extensions in the wild) to only remove the first matching cookie.
For those who wish to remove as many matching cookies as possible, the chrome.cookies.removeAll API could be introduced, similar to chrome.cookies.getAll.


And to solve the original problem that chrome.cookies.remove cannot remove a specific cookie, optional keys should be supported so that a specific cookie can be matched.

For examples, API proposal and analysis, see https://bugzilla.mozilla.org/show_bug.cgi?id=1387957#c9
 

Comment 1 by rob@robwu.nl, Apr 19 2018

Cc: rdevlin....@chromium.org mkwst@chromium.org
Questions:

- Do you agree that chrome.cookies.remove should remove only the first matching cookie?

- Do you wish to add a chrome.cookies.removeAll method to have the original behavior of removing all cookies? (similar to cookies.get vs cookies.getAll - see documentation)

- Do you approve of supporting "domain", "hostOnly", "path" in cookies.remove so that a specific cookie can be removed?
  ( its semantics are described in section 2 of https://bugzilla.mozilla.org/show_bug.cgi?id=1387957#c9 ).

Sign in to add a comment