Not a security issue.

bestpika@ Thanks for the issue.

Tested this issue on Windows 10 on the reported version 68.0.3436.0 and the latest Canary 68.0.3437.2 and unable to reproduce the issue by following the below steps.

1. Launched Chrome and synced gmail account to chrome.
2. navigated to chrome://settings/content/cookies and enabled the option "Keep local data only until you quit your browser".
3. Closed Chrome and reopened. Cannot observe any prompt to login into Google.
Attached is the screen cast for reference.

Request you to check and confirm if anything is missed from our end in triaging the issue.

Also request you to retry the issue on a new chrome profile without any flags/extensions and update the thread with the observations.

Thanks..

Deleted: 845348.mp4 1.6 MB

	845348.mp4 1.6 MB View Download

Are you sure all "chrome.exe" is closed (use taskmgr.exe)?
At this time my google account is logout.

And also I turn off "use hardware acceleration when available".

Deleted: c.png 11.7 KB

	c.png 11.7 KB View Download

Thank you for providing more feedback. Adding the requester to the cc list.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

If I turn off "keep local data only until you quit your browser" or add "[*.]google.com" to the list, it will not happen.

bestpika@ Retried the issue again on Windows 10 on the reported version 68.0.3436.1 and the latest Canary 68.0.3438.0 as per comment #3.

1. Launched Chrome and synced gmail account to chrome.
2. navigated to chrome://settings/content/cookies and enabled the option "Keep local data only until you quit your browser".
3. Closed Chrome and reopened. Cannot observe any prompt to login into Google.
4. Checked in task manager as cannot find any chrome.exe related to the chrome which we closed.

Request you to provide a scree cast of the steps followed and the issue observed which will be helpful in better understanding of the issue.

Thanks..

Use psr record.

Deleted: c.zip 1.1 MB

c.zip 1.1 MB Download

Thank you for providing more feedback. Adding the requester to the cc list.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

bestpika@ Thanks for the update.
Retried the issue on Windows 10 on the reported version 68.0.3436.0 and the latest Canary 68.0.3438.3 and unable to reproduce the issue.

CC'ing  pavely@ and treib@ from Services>Sync team and requesting them to look into this issue and help in further triaging.

Thanks..

I can reproduce on trunk: After restarting Chrome, Sync goes into the "paused" state.
This is related to DICE; it doesn't happen if I set chrome://flags/#account-consistency to Disabled. Adding signin folks for details about the linking of cookies and oauth tokens.

Thanks, this is indeed related to Dice.

This was a conscious decision and was introduced here:
 https://crbug.com/836862 

The short explanation is that Sync now requires Google cookies to work. You cannot both clear your cookies and have Sync continue working.
The options were: rebuild the Google cookie automatically at Chrome restart, or stop Sync. We opted for stopping Sync, because it seemed the most safe from a privacy perspective, and because we thought it would be less disruptive.

CC ewald in case we need to revisit that decision

Assigning to ewald, to re-evaluate and possibly close this as WAI.

To users who were active on this bug: can you explain why this new behavior is a problem to you?

So if I login another google account on web page, then browser's sync can't continue. That is a problem.

#16: I was asking specifically about the behavior related to "keep local data only until you quit your browser". Could you describe the scenario in which you would like to clear your cookies, but still want Sync to continue working?

The sync "not include cookies". So why I can't clear cookie but still sync other data?

I just don't want to login sync again after clear cookies...

Thanks for cc'ing me. I am going to mark this as WontFix (specifically because it's working as intended), but we can continue discussion on this bug.

To David's point, we are unifying the identity layers between the native Chrome browser services (i.e. sync) and other Google services on the web (which rely on Google cookies). In order to make the identities in the browser and on the web consistent, when turns on this setting to clear their cookies, we have two options: sign them out of the browser (i.e. turn off sync), or sign them back in on the web.

As David said, we decided to err on the side of safety from a privacy perspective, and sign the user out of sync as well. This may be suboptimal for users that want to clear some of their non-Google cookies on browser exit, but don't specifically care about signing out of their Google Account. However, this is a tradeoff we feel is necessary from a product/privacy point of view.

To answer the specific question raised in #16: you can definitely still log into multiple Google Accounts and continue to use Chrome Sync. The behavior in this bug is unrelated to multi-login. If you want sync to continue working across closing your browser, simply uncheck the "Keep local data only until you quit your browser" checkbox. If there are specific (non-Google) cookies you want to clear on each shutdown, then I recommend specifying the list of domains to clear in the list below, instead of checking the box to blanket remove all cookies.

Hope that helps clarify things!

I think it is better to warn user about your google account will be logout when they are trying to clear google.com cookie.

This is a good point, and this is done in a couple places:
- when the user logs out from Google on the web, they will see a warning saying that Chrome Sync is also stopping.
- when the user clears their cookies from the settings (using "Clear Browsing Data"), there will be a warning there as well (I think)

I don't think we intend to implement a warning on this "clear cookies on restart" option though, mostly because we thought that the number of impacted users would be extremely small.

It's not only that the number of impacted users is small. It's also the fact that there's not as clear of a place to put that warning. There are a lot of existing users that have already turned on the setting to clear cookies on exit. Pretty much the only spot we could put the warning would be on shutdown or startup, but that would be quite intrusive.

We could add a note next to the setting to alert users that clearing cookies will also sign them out of sync, but that wouldn't help existing users.

 Issue 863432  has been merged into this issue.