Skip to content

Commit 228c878

Browse files
authored
Expand first-party cookie expiry protection (#101)
We enforce our first-party cookie expiry policy to limit how long first-party cookies, created by third-party scripts, can persist. Let's improve the feature to: - Also enforce the cookie expiry policy for cookies created by first-party scripts. - Rename the policy to "firstPartyCookiePolicy" (from "firstPartyTrackerCookiePolicy") to better reflect the above. - Decrease the default maximum expiration to seven days (down from ten days).
1 parent f509784 commit 228c878

File tree

5 files changed

+29
-77
lines changed

5 files changed

+29
-77
lines changed

build/apple/contentScope.js

Lines changed: 7 additions & 19 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

build/chrome/inject.js

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

build/firefox/inject.js

Lines changed: 7 additions & 19 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

build/integration/contentScope.js

Lines changed: 7 additions & 19 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

src/features/cookie.js

Lines changed: 7 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -25,10 +25,9 @@ let cookiePolicy = {
2525
shouldBlockTrackerCookie: true,
2626
shouldBlockNonTrackerCookie: true,
2727
isThirdParty: isThirdParty(),
28-
tabRegisteredDomain: tabOrigin,
2928
policy: {
30-
threshold: 864000, // 10 days
31-
maxAge: 864000 // 10 days
29+
threshold: 604800, // 7 days
30+
maxAge: 604800 // 7 days
3231
}
3332
}
3433

@@ -125,24 +124,13 @@ export function load (args) {
125124
try {
126125
// wait for config before doing same-site tests
127126
loadPolicyThen(() => {
128-
const { shouldBlock, tabRegisteredDomain, policy, isTrackerFrame } = cookiePolicy
127+
const { shouldBlock, policy } = cookiePolicy
129128

130-
if (!tabRegisteredDomain || !shouldBlock) {
131-
// no site domain for this site to test against, abort
129+
if (!shouldBlock) {
132130
debugHelper('ignore', 'disabled', setCookieContext)
133131
return
134132
}
135-
const sameSiteScript = [...scriptOrigins].every((host) => matchHostname(host, tabRegisteredDomain))
136-
if (sameSiteScript) {
137-
// cookies set by scripts loaded on the same site as the site are not modified
138-
debugHelper('ignore', '1p sameSite', setCookieContext)
139-
return
140-
}
141-
const trackerScript = [...scriptOrigins].some((host) => trackerHosts.has(host))
142-
if (!trackerScript && !isTrackerFrame) {
143-
debugHelper('ignore', '1p non-tracker', setCookieContext)
144-
return
145-
}
133+
146134
// extract cookie expiry from cookie string
147135
const cookie = new Cookie(value)
148136
// apply cookie policy
@@ -151,7 +139,7 @@ export function load (args) {
151139
if (document.cookie.split(';').findIndex(kv => kv.trim().startsWith(cookie.parts[0].trim())) !== -1) {
152140
cookie.maxAge = policy.maxAge
153141

154-
debugHelper('restrict', 'tracker', scriptOrigins)
142+
debugHelper('restrict', 'expiry', scriptOrigins)
155143

156144
cookieSetter.apply(document, [cookie.toString()])
157145
} else {
@@ -182,7 +170,7 @@ export function init (args) {
182170
const featureName = 'cookie'
183171
cookiePolicy.shouldBlockTrackerCookie = getFeatureSettingEnabled(featureName, args, 'trackerCookie')
184172
cookiePolicy.shouldBlockNonTrackerCookie = getFeatureSettingEnabled(featureName, args, 'nonTrackerCookie')
185-
const policy = getFeatureSetting(featureName, args, 'firstPartyTrackerCookiePolicy')
173+
const policy = getFeatureSetting(featureName, args, 'firstPartyCookiePolicy')
186174
if (policy) {
187175
cookiePolicy.policy = policy
188176
}

0 commit comments

Comments
 (0)