Skip to content

Commit

Permalink
Expand first-party cookie expiry protection (#101)
Browse files Browse the repository at this point in the history
We enforce our first-party cookie expiry policy to limit how long
first-party cookies, created by third-party scripts, can
persist. Let's improve the feature to:
 - Also enforce the cookie expiry policy for cookies created by
   first-party scripts.
 - Rename the policy to "firstPartyCookiePolicy" (from
   "firstPartyTrackerCookiePolicy") to better reflect the above.
 - Decrease the default maximum expiration to seven days (down from
   ten days).
  • Loading branch information
kzar authored Jun 23, 2022
1 parent f509784 commit 228c878
Show file tree
Hide file tree
Showing 5 changed files with 29 additions and 77 deletions.
26 changes: 7 additions & 19 deletions build/apple/contentScope.js

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion build/chrome/inject.js

Large diffs are not rendered by default.

26 changes: 7 additions & 19 deletions build/firefox/inject.js

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

26 changes: 7 additions & 19 deletions build/integration/contentScope.js

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

26 changes: 7 additions & 19 deletions src/features/cookie.js
Original file line number Diff line number Diff line change
Expand Up @@ -25,10 +25,9 @@ let cookiePolicy = {
shouldBlockTrackerCookie: true,
shouldBlockNonTrackerCookie: true,
isThirdParty: isThirdParty(),
tabRegisteredDomain: tabOrigin,
policy: {
threshold: 864000, // 10 days
maxAge: 864000 // 10 days
threshold: 604800, // 7 days
maxAge: 604800 // 7 days
}
}

Expand Down Expand Up @@ -125,24 +124,13 @@ export function load (args) {
try {
// wait for config before doing same-site tests
loadPolicyThen(() => {
const { shouldBlock, tabRegisteredDomain, policy, isTrackerFrame } = cookiePolicy
const { shouldBlock, policy } = cookiePolicy

if (!tabRegisteredDomain || !shouldBlock) {
// no site domain for this site to test against, abort
if (!shouldBlock) {
debugHelper('ignore', 'disabled', setCookieContext)
return
}
const sameSiteScript = [...scriptOrigins].every((host) => matchHostname(host, tabRegisteredDomain))
if (sameSiteScript) {
// cookies set by scripts loaded on the same site as the site are not modified
debugHelper('ignore', '1p sameSite', setCookieContext)
return
}
const trackerScript = [...scriptOrigins].some((host) => trackerHosts.has(host))
if (!trackerScript && !isTrackerFrame) {
debugHelper('ignore', '1p non-tracker', setCookieContext)
return
}

// extract cookie expiry from cookie string
const cookie = new Cookie(value)
// apply cookie policy
Expand All @@ -151,7 +139,7 @@ export function load (args) {
if (document.cookie.split(';').findIndex(kv => kv.trim().startsWith(cookie.parts[0].trim())) !== -1) {
cookie.maxAge = policy.maxAge

debugHelper('restrict', 'tracker', scriptOrigins)
debugHelper('restrict', 'expiry', scriptOrigins)

cookieSetter.apply(document, [cookie.toString()])
} else {
Expand Down Expand Up @@ -182,7 +170,7 @@ export function init (args) {
const featureName = 'cookie'
cookiePolicy.shouldBlockTrackerCookie = getFeatureSettingEnabled(featureName, args, 'trackerCookie')
cookiePolicy.shouldBlockNonTrackerCookie = getFeatureSettingEnabled(featureName, args, 'nonTrackerCookie')
const policy = getFeatureSetting(featureName, args, 'firstPartyTrackerCookiePolicy')
const policy = getFeatureSetting(featureName, args, 'firstPartyCookiePolicy')
if (policy) {
cookiePolicy.policy = policy
}
Expand Down

0 comments on commit 228c878

Please sign in to comment.