Thirdparty: Difference between revisions

→‎Implementation: Linkify bugs
(→‎Implementation: Linkify bugs)
 
(2 intermediate revisions by one other user not shown)
Line 66: Line 66:
== Rationale ==
== Rationale ==


Again, let me reiterate -- what matters here is '''not''' ''how the user thinks of a particular action'', but ''whether the action is related, in an integral way, with the current site''. This may seem counterintuitive, but: given that we're having per-site cookie sandboxes, the problem now comes down to which sandbox to put each cookie into. This is less related to user perception than to how tightly coupled a given transaction is with a given sandbox.
Again, let me reiterate -- what matters here is '''not''' ''how the user thinks of a particular action'', but ''whether the action is related, in an integral way, with the current site''. This may seem counterintuitive, but: assume we have per-site cookie sandboxes; the problem now comes down to which sandbox to put each cookie into. This is less related to user perception than to how tightly coupled a given transaction is with a given sandbox.


We have some hard data points here, but more is always better, and will allow us to make a more informed decision on how these changes will affect the web.
We have some hard data points here, but more is always better, and will allow us to make a more informed decision on how these changes will affect the web.
Line 102: Line 102:
= Implementation =
= Implementation =


'''Step 1:''' Make third party cookies persist for the session only, by default. (Can be disabled by a ''network.cookie.thirdparty.sessionOnly'' pref.) See bug 565475; patch up.
Relevant bugs:


'''Step 2:''' Double-key cookies by (first party domain, setting domain). See bug 565965; patch in progress.
* {{Bug|565965}}: Double-key cookies by (first party domain, setting domain). Work is in progress.


'''Step 3:''' Implement the first party carry-over rules described above, probably as a separate service such that localstorage etc. can use it.
* {{Bug|565475}}: Make third party cookies persist for the session only. This is controlled by a hidden pref, ''network.cookie.thirdparty.sessionOnly''. Landed on trunk.
 
* Develop a more intuitive way for the user to indicate that they trust a certain site to interact with other sites.
 
* Implement the first party carry-over rules described above, probably as a separate service such that localstorage etc. can use it.
 
* Apply the rules developed here to localstorage and such.


= Further Steps =
= Further Steps =
Confirmed users
1,247

edits