Bug 209547 – Cookies can be sent to a 3rd party context

• Status: RESOLVED
• Resolution: INVALID
• Component: New Bugs

[Eric Lawrence (MSFT)]

Created attachment 394513 [details]
example of unexpected cookies

In playing with these two test pages:

http://enhanceie.com/test/cookie/
http://www.debugtheweb.com/test/cookie/default2.asp

Sometimes using the "Swap 1st party and 3rd Party" button to open cross-origin versions of the pages.

... I sometimes find that cookies are being sent to a 3rd party site.

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1 Safari/605.1.15

Other screenshots at https://twitter.com/ericlaw/status/1242852252940935171

[John Wilander]

Thanks so much for filing, Eric! We appreciate developers and other browser engineers having a look at our features and letting us know about any unexpected behavior or bugs.

I did testing with your test rig and I believe you are hitting our temporary compatibility fix for popups.

If a debugtheweb.com window is opened from enhanceie.com via window.open(), and the debugtheweb.com child window gets user interaction, third-party cookie access is opened up for debugtheweb.com under the parent page from enhanceie.com. This is to allow legacy federated login flows to still work and originally shipped in 2018 (see "Temporary Compatibility Fix: Automatic Storage Access for Popups" in https://webkit.org/blog/8311/intelligent-tracking-prevention-2-0/) and was later restricted with the user interaction requirement in the popup/child window (see "Removed Compatibility Fix for Popups" in https://webkit.org/blog/8613/intelligent-tracking-prevention-2-1/). This compatibility measure has also been added to the explainer in the standardization process of the Storage Access API: https://github.com/privacycg/storage-access/blob/master/README.md#compatibility-measure

With this information, could you confirm that what you're seeing is expected behavior? Thanks!

[Eric Lawrence (MSFT)]

Thanks, John! I'll play with this a bit more, but it certainly does sound like the window.open() accommodation.

I tried enabling the ITP debug mode but I wasn't sure where the "Filter" option is in the console (as documented here: https://webkit.org/blog/9521/intelligent-tracking-prevention-2-3/)-- Are these still the right steps for the latest version of Safari?

[John Wilander]

(In reply to Eric Lawrence (MSFT) from comment #2)
> Thanks, John! I'll play with this a bit more, but it certainly does sound
> like the window.open() accommodation.

Thanks!
> I tried enabling the ITP debug mode but I wasn't sure where the "Filter"
> option is in the console (as documented here:
> https://webkit.org/blog/9521/intelligent-tracking-prevention-2-3/)-- Are
> these still the right steps for the latest version of Safari?

I've always had best luck with Terminal filtering:
log stream -info | grep ITPDebug

[Eric Lawrence (MSFT)]

Yes, it looks like this is the compat accommodation; the first time I refresh the page, I see:

2020-03-25 14:41:09.503790-0500 0xe1de     Info        0x0                  1501   0    com.apple.WebKit.Networking: (WebKit) [com.apple.WebKit:ITPDebug] [Temporary combatibility fix] Storage access was granted for debugtheweb.com under opener page from enhanceie.com, with user interaction in the opened window.



Note: " [Temporary combatibility fix] " has what looks like a funny typo. :)


So, based on this, I think you can resolve this as "Working as Intended"

[John Wilander]

(In reply to Eric Lawrence (MSFT) from comment #4)
> Yes, it looks like this is the compat accommodation; the first time I
> refresh the page, I see:
> 
> 2020-03-25 14:41:09.503790-0500 0xe1de     Info        0x0                 
> 1501   0    com.apple.WebKit.Networking: (WebKit)
> [com.apple.WebKit:ITPDebug] [Temporary combatibility fix] Storage access was
> granted for debugtheweb.com under opener page from enhanceie.com, with user
> interaction in the opened window.
> 
> 
> 
> Note: " [Temporary combatibility fix] " has what looks like a funny typo. :)

That is indeed funny. Issue of the day!
> So, based on this, I think you can resolve this as "Working as Intended"

Thanks!