NPAPI:ClearSiteData

Status

Under consideration.

Problem Summary

Allow browsers to request that plugins clear locally stored private data.

Overview of current UIs

Type	Firefox	IE	Opera	Safari	Chrome
Browsing History	yes	yes	yes	yes	yes
Download History	yes	yes	yes	yes	yes
Form History	yes	yes	?	yes	yes
Search History	yes	?	?	?	?
Cookies	yes	yes	temporary/all	yes	yes
Cache	yes	yes	yes	yes	yes
Active Logins	yes	yes	"password manager"	yes	yes
Site Preferences	yes	?	?	?	?

In addition, IE has "InPrivate Filtering Data" (what is this?)

In addition, Opera has "delete password protected pages and data" and "bookmark visited times".

In addition, Safari has "webpage preview images", "website icons" and "top sites"

Parameters	Firefox	IE	Opera	Safari	Chrome
Time Range	yes	no	no	no	yes
By Site	yes (context menu in history)	??	??	??	??

Existing Discussion and Documentation

Mail thread on plugin-futures: https://mail.mozilla.org/private/plugin-futures/2010-January/001150.html

In particular, Lloyd Hilaiel proposed an alternate approach where plugins would store everything in a standard filesystem based layout, so the UA itself can do the clearing. See https://mail.mozilla.org/private/plugin-futures/2010-January/001156.html

Flash Local Storage: http://www.macromedia.com/support/documentation/en/flashplayer/help/help02.html

Firefox issue - clearing local storage with time range: https://bugzilla.mozilla.org/show_bug.cgi?id=527667

API Requirements

Clearing Privacy Data needs to be independent of whether the plugin is currently instantiated.

Type of Data

Flags:

• things the user enters, except for credentials (form data)

• credentials

• things cached by the UA (pages, preview images, icons)

• local data stored by the server / web application (cookies, HTML5 local storage, Flash/Silverlight local storage)

• history information (bookmarks, visited URIs)

• settings specific to a site (for instance, preferences with respect to privacy, script disabling...)

Time range

Several UAs offer to restrict the clear operation to a time range such as "today" or "last week".

In the API, this can be exposed as "last N minutes", or something like that.

We need to allow plugins to signal that they can't clear by time range, though.

(Return code, plus discoverability beforehand?)

Site/URI

Firefox supports "forget about this site". Other UAs do not appear to support this.

Should it be part of the API? If so, what format?

Current Proposal

• Last modified: May 27, 2010
• Author: Julian Reschke (greenbytes), Dan Witte <dwitte@mozilla.com>

The current proposal is to add a new method, providing the new functionality:

NPError NPN_ClearSiteData(
  NPP instance,
  PRUint64 flags,         // what type of data to clear
  const char* domain,     // limit to domain
  PRUInt64 maxAge         // max. age of information in seconds
);

New NPError codes:

// can't clear by time range
#define NPERR_TIMERANGE_NOT_SUPPORTED (NPERR_BASE + mm)
// can't clear by domain/site
#define NPERR_LIMITBYSITE_NOT_SUPPORTED (NPERR_BASE + nn)
// malformed 'domain' string
#define NPERR_MALFORMED_DOMAIN (NPERR_BASE + ll)

Semantics:

• flags is a bitset representing which type(s) of data to clear; 0 means "clear all types".
• The domain argument is interpreted as follows:
  • if a hostname of the form "foo.com", data in the "foo.com" domain and all subdomains should be cleared. In this form, domain must be a normalized ACE-encoded hostname, lowercased; must not contain a trailing dot; must not contain scheme, port, or other such fields; and must contain at least one embedded dot;
  • if an IP address (either IPv4 or IPv6), data for that IP should be cleared;
  • if NULL, all site-specific data and more generic data on browsing history (for instance, number of sites visited) should be cleared.
• maxAge is the maximum age of data to clear, inclusive, in seconds. If maxAge is 0, no data is cleared. If maxAge is the maximum unsigned 64-bit integer, all data is cleared.

Open Issues

• Do we need a discovery method?
• Should it be possible to clear all types with a single call? In which case the flags should be passed as bit set; this would also allow a forwards-compatible "delete-all"
  • [dwitte] Yes: flags == 0 should mean "clear everything".
• What is the behavior of the 'site' argument? does 'foo.com' clear data for 'foo.com' and all subdomains? Does it work for IP addresses?
• If 'site' is NULL or the empty string, does all data get cleared?
• Does maxAge == 0 clear data regardless of age? Or maxAge == 2^31 - 1?
• 'NPN_ClearPrivacyData' seems like a strange name. 'NPN_ClearSiteData' perhaps?
• what's the syntax for an IPv6 address in site? As per RFC 3986 "IP-literal" ([1])?
• What should be the behavior when the plugin is not in memory or not running? Does it need to "clear privacy information" on next invocation? How to make the solution cross-OS?