145734 2015-06-07 02:09:14 -0700 [GTK] setting document.cookie from same domain in private mode overwrites previous value set in another webview 2017-03-11 10:55:51 -0800 1 1 1 Unclassified WebKit WebKit2 528+ (Nightly build) Unspecified Linux NEW P2 Normal --- 1 kapouer webkit-unassigned bugs-noreply cgarcia danw dbates gustavo mcatanzaro svillar oldest_to_newest 1100170 0 254434 kapouer 2015-06-07 02:09:14 -0700 Created attachment 254434 test.cc and server.js to reproduce Hi, if i do this: ``` load blank page in private webview http://localhost:40001/one page change http://localhost:40001/one 0 page change http://localhost:40001/one 2 page change http://localhost:40001/one 3 set cookie by running script on page http://localhost:40001/one document.cookie = 'sid=firstcookie; Path=/'; loading blank page in another private webview http://localhost:40001/two page change http://localhost:40001/two 0 page change http://localhost:40001/two 2 page change http://localhost:40001/two 3 set cookie by running script on page http://localhost:40001/two document.cookie = 'sid=secondcookie; Path=/'; load actual page1 content with script that do a xhr GET request to /xhr (need a http server) page change http://localhost:40001/one 0 page change http://localhost:40001/one 2 page change http://localhost:40001/one 3 ``` then the HTTP server receives a request to http://localhost:40001/xhr with these headers: ``` { host: 'localhost:40001', referer: 'http://localhost:40001/one', 'user-agent': 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/601.1 (KHTML, like Gecko) Version/8.0 Safari/601.1', accept: '*/*', 'accept-encoding': 'gzip, deflate', 'accept-language': 'fr-fr', connection: 'Keep-Alive', cookie: 'sid=secondcookie' } ``` I expected cookie to be 'sid=firstcookie', especially in private mode. Am i wrong ? I attach actual code to reproduce with webkit2gtk 2.8 or 2.9 (and probably 2.6 too). The server part is a nodejs script but any other server is good. 1100180 1 mcatanzaro 2015-06-07 05:23:04 -0700 > I expected cookie to be 'sid=firstcookie', especially in private mode. > Am i wrong ? I think cookies should never leak out of private mode. :( 1136795 2 kapouer 2015-10-27 03:13:40 -0700 Still happening with webkit2gtk up to 2.10.3 1136818 3 mcatanzaro 2015-10-27 09:37:58 -0700 Oh, you're using the enable-private-browsing setting... Carlos, is that setting supposed to be exposed? In Epiphany we implement private browsing by using a separate profile directory and deleting the directory when we're done. I'm rather concerned that we have this setting if it doesn't work reliably. I've seen private browsing-related bugs fixed in Mac-specific ways in the past, which I thought was fine because I didn't realize we exposed this mode. 1136819 4 kapouer 2015-10-27 09:41:40 -0700 I thought someone would come and tell me "you did not enable private browsing so it's not a bug" - so i enabled the option, but you'll get the same result without it. 1209641 5 283316 kapouer 2016-07-11 07:30:08 -0700 Created attachment 283316 client test with a new context There was a bug in the test itself (the second view was used to load the first page). However, fixing that bug without setting a new context on each view does not isolate cookies. 1209643 6 kapouer 2016-07-11 07:32:04 -0700 So i finally understood how to isolate cookies by setting a new context for each new view. So the only "bug" left is the fact "private mode" setting is misleading, and should be dropped and replaced by proper use of context (?). 254434 2015-06-07 02:09:14 -0700 2015-06-07 02:09:14 -0700 test.cc and server.js to reproduce bug.tar.xz application/octet-stream 2008 kapouer /Td6WFoAAATm1rRGAgAhARYAAAB0L+Wj4CP/B5ddADEdSQ4Q07pN3sxdqQVVsrwddMbBy5b7kSNE YbLDhHoZepLEdE2b40byoTL2TAl0rnPTlsslsT8RERTRVouvxcJd8vZJtiaZVvgFj7+rg0+k2dxN uOUH3ij5NE9iqFsM6QLFLZxFwoa1NeaC+qQUTCOdKiIfh8//wVZljOYKtm0AtiBmYCP+qwncsaeX JA0NJlsIo1cyGCHphowv7FlqWplw2LO8Z+1VRHgBPVxKs4KqK6fK1E7Xqa0IEHkkkGYM/u5pxOC6 EnNzizz+6pepfkNKV48tABmiNyWDxHHXszcG1lX0mpaRXleG/KaOvRo22Ji54jAtNNpt8dkFiSUI AVbEWjsyYZDn0yswY2EPeNQWRPV6rxq05f97umNHOdzvnY5jCPYdm7chr0+Fda7/7hJM9e8sh//j IqXavRltKyCGlP2hXY82iF+e7a9VD9M6cGbVZcrQ7Qem467l+xw6r5nOoB5EhhWejpL9Ke/g5Vhn 9UqfAJ1+sXr5t6mM4E8XysGEwk4wzMviqfBoNlmdpI9qccduJ/fB/sbGHnPovD5xDabNQwM5CM2B O9na5mYeCMIKxWLrIbWMoiR9t4f2K86OV2LUv4JkgnSBTF7SiDS2pXAMHkIUS1BePwGO4AWiEBGV 1MDCBMzCcCTy32KFTF1A/oiQB85cDoFMHeCLtiepdTk0UD1fpiru636IbE7UiQaKsti4MkaKy1La hazLeDMQcfhk9HdqaGxeJXicoKQEO8g6MA1rvuUhfXlBRph/vBIwcZg8RnxqroKk0DGymO6aUsbd CWOQHoymKsXJkq2TdxGek5Nhw//x9mhBtOPZscyq9fc+dNd+CjSZ1IogqUFOldTM7vxbgvrDQ4NO +xfkNdvmR+QDFz6+gic5wZzpVxtogxYaaK+4p93DUB/woVDZMYvWX6miB6P4BNdAM1WxTXbaB4XL cxbQJFC0R/Gs1KiOg4CPYJv90pm7S4B3DSmnekjcJb2v5JnbceZadpg5kYfnaeIm2dev3a9IcoOr p5rlJy77DeGHornYO1h55vk5Ww8usT5Ri5oBoGrb0SArO7vYhq+zqrL+9vDJudoWMuZE5WVxwlsm gN5ZZfL9lvAoox1uIHVrJYE+AVM1501lDMXq5aGvxpZY38I+eDhT8lyOXDhCBdavE+ZixCY8n4o6 FUpE2zf90Wf/TmGweC+IXCkwKguSWVJPJSK0Tu+nYIhM5uHuf2W+wOKOcLxv9NnLnEquJnpnrlvm m8yVjkWx+iiOoo+iXdTYE0UAmrj402g/gRtNLwtgnxQIH95Jdt1/sW8Hwc8JwitgKxVo+EiovHhd 8XUSH1BCdsVUHJahzqtGGwH2L+4tN0+1y5DfUBdAMBSy6FXdeLH9peMrFgcXftI38L8WRS2Ik5z2 KaCCJwQDFs2rQZaBxCEP2r0nbMbY0kItUKNmKXjpsQKmVpI5yK3R0EAcfJFRmczQbEI6mA9LRh0I ji71PdcddcZmvdnWKIRQvzI/yOHkbNvhsMqcfEsMLalQ8xv/RvlYOUHTL0MbN0EjXcEs9KUVlGwO pPrNggK/bbrYaYo5JHKzD+tN6gXorEMu4POEbqVbHVdGNuy5k1wzvp73ywla5w/37Af4R7bCV6Pt AwdqQwNEfkYXhoYh0jy44FHGBpnhkr3uAmNmrZZFs7gEO2LFAV7Vx20bVQn9AveWU0K8Xd07HgFH 22w4jvPSz41Re1Vnb4uIrUTFf146Itu+1qgu3/h6umYbWITK+b8B8MQLdU6XrOdD5suxwbPxtN2v on17CfyFBr0Cab6FhavY7puwBmIHgixPr/ZDid3fCIldet8e7jA6/qyR/a2CC/4rA1MTY/u3CP+B geVmExufj7oFgZqBQLtMcuBveyewvrCT6V8px0472Si93O4/grkARTSjkF8kYMZX9eO/hV+HTFXo fqRDFuck/W6MZJ0LkTLqcv1gSo0uNuDzNEqIYcFc4pdgWgF0tusbPjZkdmYqPFnFJNN1e4hk+8gt QIkTOUA91p4fjRdfnGZsSAWFcBYqoULAw5lTD5/dH3wbHosw8bKjUnKkty/bT7JT1/S/iXE+IcHy wvde71/uZFSueNevY3/3Tg8HM9n3cW0AefNXGLmtEtAu/suKOII2A9huFGejUqaftG+976Jz6vKp CR/ibhGSOxFGqaAE6ttWGJHZc/pNI4sq7jkDCer2DPixSxuUup1cWJhoClyXfJ4CmpZsXFo8HvpF p5y3VJuo/0ZZc4gMibQIWNv9QilfSkve7yv/hU2scbQjo2AmacHVOF1mV+VU8EFwf7GcaT+Fm7u9 PPsvBeqZc5uQ59Q42B497JxSe7VsaRPNcYr4ZoOQHqx6qEBWwo/HMgqN8NSE/G1nU8nlMYLeT8ud PBF4pRKOSD5wDt4GVat8bNYRkepwNvSOH7DDUlVFDACEqX/si09c45cRLgP+LO7RDGKPHP1/H3Ia gBmDOWOTYHxxQIZKXYbM5hrWRIptAXWf6phN8H/Thj++sk1Sxhl8BMylwhpAlK1eCFZiPaJZ0yxT 4U3lvrlAr2DX47f9OrczopnQ+bf7GAUjRjHIt6GQ80/2kLIAAABzy/iIvi/B0QABsw+ASAAAlEiL TrHEZ/sCAAAAAARZWg== 283316 2016-07-11 07:30:08 -0700 2016-07-11 07:30:08 -0700 client test with a new context test.cc application/octet-stream 3644 kapouer I2luY2x1ZGUgPGd0ay9ndGsuaD4KI2luY2x1ZGUgPHdlYmtpdDIvd2Via2l0Mi5oPgoKCmJvb2wg bG9hZDEgPSBGQUxTRTsKYm9vbCBsb2FkMiA9IEZBTFNFOwpjb25zdCBnY2hhciogdXJpMSA9ICJo dHRwOi8vbG9jYWxob3N0OjQwMDAxL29uZSI7CmNvbnN0IGdjaGFyKiB1cmkyID0gImh0dHA6Ly9s b2NhbGhvc3Q6NDAwMDEvdHdvIjsKY29uc3QgZ2NoYXIqIHNldENvb2tpZTEgPSAiZG9jdW1lbnQu Y29va2llID0gJ3NpZD1maXJzdGNvb2tpZSc7IjsKY29uc3QgZ2NoYXIqIHNldENvb2tpZTIgPSAi ZG9jdW1lbnQuY29va2llID0gJ3NpZD1zZWNvbmRjb29raWUnOyI7CmNvbnN0IGdjaGFyKiBwYWdl MSA9ICI8aHRtbD48c2NyaXB0IHR5cGU9J3RleHQvamF2YXNjcmlwdCc+XAp2YXIgeGhyID0gbmV3 IFhNTEh0dHBSZXF1ZXN0KCk7XAp4aHIub3BlbignR0VUJywgJ2h0dHA6Ly9sb2NhbGhvc3Q6NDAw MDEveGhyJywgdHJ1ZSk7XAp4aHIuc2VuZCgpO1wKPC9zY3JpcHQ+PC9odG1sPiI7CgpXZWJLaXRX ZWJWaWV3KiB2aWV3MTsKV2ViS2l0V2ViVmlldyogdmlldzI7CgpzdGF0aWMgV2ViS2l0V2ViVmll dyogbG9hZGJsYW5rc2V0Y29vb2tpZShjb25zdCBnY2hhciosIGNvbnN0IGdjaGFyKik7CgppbnQg bWFpbihpbnQgYXJnYywgY2hhciAqYXJndltdKSB7CglndGtfaW5pdF9jaGVjaygmYXJnYywgJmFy Z3YpOwoJdmlldzEgPSBsb2FkYmxhbmtzZXRjb29va2llKHVyaTEsICJ1cmkxIik7CglndGtfbWFp bigpOwp9CgpzdGF0aWMgdm9pZCBydW5Eb25lKEdPYmplY3QqIG9iamVjdCwgR0FzeW5jUmVzdWx0 KiByZXN1bHQsIHZvaWQqKSB7CglHRXJyb3IqIGVyciA9IE5VTEw7CglXZWJLaXRXZWJWaWV3KiB2 aWV3ID0gV0VCS0lUX1dFQl9WSUVXKG9iamVjdCk7Cgljb25zdCBnY2hhciogdXJpID0gd2Via2l0 X3dlYl92aWV3X2dldF91cmkodmlldyk7CglXZWJLaXRKYXZhc2NyaXB0UmVzdWx0KiBqc19yZXN1 bHQgPSB3ZWJraXRfd2ViX3ZpZXdfcnVuX2phdmFzY3JpcHRfZmluaXNoKHZpZXcsIHJlc3VsdCwg JmVycik7CglpZiAoanNfcmVzdWx0ID09IE5VTEwpIHsKCQlnX3ByaW50ZXJyKCJlcnJvciBydW5u aW5nIHNjcmlwdCAlc1xuIiwgZXJyKTsKCQlnX2Vycm9yX2ZyZWUoZXJyKTsKCQlyZXR1cm47Cgl9 Cgl3ZWJraXRfamF2YXNjcmlwdF9yZXN1bHRfdW5yZWYoanNfcmVzdWx0KTsKCWlmIChnX3N0cmNt cDAodXJpLCB1cmkxKSA9PSAwKSB7CgkJdmlldzIgPSBsb2FkYmxhbmtzZXRjb29va2llKHVyaTIs ICJ1cmkyIik7Cgl9IGVsc2UgewoJCWdfcHJpbnQoImxvYWQgYWN0dWFsIHBhZ2UxIGNvbnRlbnQg d2l0aCBzY3JpcHQgdGhhdCBkbyBhIHhociBHRVQgcmVxdWVzdCB0byAveGhyIChuZWVkIGEgaHR0 cCBzZXJ2ZXIpXG4iKTsKCQkvLyBUT0RPIHZpZXcgaXMgdGhlIHNlY29uZCB2aWV3ICEhIQoJCXdl YmtpdF93ZWJfdmlld19sb2FkX2h0bWwodmlldzEsIHBhZ2UxLCB1cmkxKTsKCX0KfQoKCnN0YXRp YyB2b2lkIGNoYW5nZShXZWJLaXRXZWJWaWV3KiB2aWV3LCBXZWJLaXRMb2FkRXZlbnQgbG9hZF9l dmVudCwgZ3BvaW50ZXIgZGF0YSkgewoJY29uc3QgZ2NoYXIqIHVyaSA9IHdlYmtpdF93ZWJfdmll d19nZXRfdXJpKHZpZXcpOwoJZ19wcmludCgicGFnZSBjaGFuZ2UgJXMgJWQgXG4iLCB1cmksIGxv YWRfZXZlbnQpOwoJaWYgKGxvYWRfZXZlbnQgIT0gV0VCS0lUX0xPQURfRklOSVNIRUQpIHJldHVy bjsKCWlmIChnX3N0cmNtcDAodXJpLCB1cmkxKSA9PSAwKSB7CgkJaWYgKGxvYWQxID09IEZBTFNF KSB7CgkJCWdfcHJpbnQoInNldCBjb29raWUgYnkgcnVubmluZyBzY3JpcHQgb24gcGFnZSAlc1xu JXNcbiIsIHVyaSwgc2V0Q29va2llMSk7CgkJCWxvYWQxID0gVFJVRTsKCQkJd2Via2l0X3dlYl92 aWV3X3J1bl9qYXZhc2NyaXB0KHZpZXcsIHNldENvb2tpZTEsIE5VTEwsIHJ1bkRvbmUsIE5VTEwp OwoJCX0gZWxzZSB7CgkJCS8vIERPTkUgcGFnZSBvbmUKCQl9Cgl9CglpZiAoZ19zdHJjbXAwKHVy aSwgdXJpMikgPT0gMCkgewoJCWlmIChsb2FkMiA9PSBGQUxTRSkgewoJCQlnX3ByaW50KCJzZXQg Y29va2llIGJ5IHJ1bm5pbmcgc2NyaXB0IG9uIHBhZ2UgJXNcbiVzXG4iLCB1cmksIHNldENvb2tp ZTIpOwoJCQlsb2FkMiA9IFRSVUU7CgkJCXdlYmtpdF93ZWJfdmlld19ydW5famF2YXNjcmlwdCh2 aWV3LCBzZXRDb29raWUyLCBOVUxMLCBydW5Eb25lLCBOVUxMKTsKCQl9IGVsc2UgewoJCQkvLyBE T05FIHBhZ2UgdHdvCgkJfQoJfQp9CgpzdGF0aWMgV2ViS2l0V2ViVmlldyogbG9hZGJsYW5rc2V0 Y29vb2tpZShjb25zdCBnY2hhciogdXJsLCBjb25zdCBnY2hhciogY2FjaGUpIHsKCWdfcHJpbnQo ImxvYWRpbmcgbmV3IHBhZ2UgJXNcbiIsIHVybCk7CglXZWJLaXRXZWJzaXRlRGF0YU1hbmFnZXIq IGRhdGFNYW5hZ2VyID0gd2Via2l0X3dlYnNpdGVfZGF0YV9tYW5hZ2VyX25ldygKCQkiYmFzZS1j YWNoZS1kaXJlY3RvcnkiLCBjYWNoZSwKCQkiYmFzZS1kYXRhLWRpcmVjdG9yeSIsIGNhY2hlLAoJ CU5VTEwKCSk7CglXZWJLaXRXZWJDb250ZXh0KiBjb250ZXh0ID0gd2Via2l0X3dlYl9jb250ZXh0 X25ld193aXRoX3dlYnNpdGVfZGF0YV9tYW5hZ2VyKGRhdGFNYW5hZ2VyKTsKLy8JV2ViS2l0V2Vi Q29udGV4dCogY29udGV4dCA9IHdlYmtpdF93ZWJfY29udGV4dF9nZXRfZGVmYXVsdCgpOwoJd2Vi a2l0X3dlYl9jb250ZXh0X3NldF9wcm9jZXNzX21vZGVsKGNvbnRleHQsIFdFQktJVF9QUk9DRVNT X01PREVMX01VTFRJUExFX1NFQ09OREFSWV9QUk9DRVNTRVMpOwoJd2Via2l0X3dlYl9jb250ZXh0 X3NldF9jYWNoZV9tb2RlbChjb250ZXh0LCBXRUJLSVRfQ0FDSEVfTU9ERUxfV0VCX0JST1dTRVIp OwoJV2ViS2l0Q29va2llTWFuYWdlciogY29va2llTWFuYWdlciA9IHdlYmtpdF93ZWJfY29udGV4 dF9nZXRfY29va2llX21hbmFnZXIoY29udGV4dCk7Cgl3ZWJraXRfY29va2llX21hbmFnZXJfZGVs ZXRlX2FsbF9jb29raWVzKGNvb2tpZU1hbmFnZXIpOwoJd2Via2l0X2Nvb2tpZV9tYW5hZ2VyX3Nl dF9hY2NlcHRfcG9saWN5KGNvb2tpZU1hbmFnZXIsIFdFQktJVF9DT09LSUVfUE9MSUNZX0FDQ0VQ VF9OT19USElSRF9QQVJUWSk7CglXZWJLaXRXZWJWaWV3KiB2aWV3ID0gV0VCS0lUX1dFQl9WSUVX KHdlYmtpdF93ZWJfdmlld19uZXdfd2l0aF9jb250ZXh0KGNvbnRleHQpKTsKCUd0a1dpZGdldCog d2luZG93ID0gZ3RrX29mZnNjcmVlbl93aW5kb3dfbmV3KCk7CglndGtfY29udGFpbmVyX2FkZChH VEtfQ09OVEFJTkVSKHdpbmRvdyksIEdUS19XSURHRVQodmlldykpOwoJZ3RrX3dpZGdldF9zaG93 X2FsbCh3aW5kb3cpOwoJZ19zaWduYWxfY29ubmVjdCh2aWV3LCAibG9hZC1jaGFuZ2VkIiwgR19D QUxMQkFDSyhjaGFuZ2UpLCBOVUxMKTsKCVdlYktpdFNldHRpbmdzKiBzZXR0aW5ncyA9IHdlYmtp dF93ZWJfdmlld19nZXRfc2V0dGluZ3Modmlldyk7CglnX29iamVjdF9zZXQoc2V0dGluZ3MsCgkJ ImVuYWJsZS1wbHVnaW5zIiwgRkFMU0UsCgkJImVuYWJsZS1qYXZhc2NyaXB0IiwgVFJVRSwKCQki ZW5hYmxlLXBhZ2UtY2FjaGUiLCBGQUxTRSwKCQlOVUxMCgkpOwoJd2Via2l0X3dlYl92aWV3X2xv YWRfaHRtbCh2aWV3LCAiPGh0bWw+PC9odG1sPiIsIHVybCk7CglyZXR1cm4gdmlldzsKfQo=