Could you explain me something ?

[LaurentGrenet]

Hi,

there is something I do not understand, so if someone (maybe @Lusito ?) can explain, I would be very happy.... because it would help me to be less "stupid" to define rules I need ....

My "default rule" is to delete when EXITING if no rule match I have also activated the option "Delete third party cookies as soon as created : 5 seconds" And on the domain of my bank, I have ONLY ONE rule : Domain "www.banquepopulaire.fr" / NEVER

To log into my personal account on the website, I have to open a URL at https://www.banquepopulaire.fr/.... onto which page I provide my credentials, and at the end, displayed page is at https://www.ibps.bpaura.banquepopulaire.fr/....

When I'm logged in, there are a lot of cookies on the following domains (checked with Cookie Quick Manager extension) : .banquepopulaire.fr .www.ibps.bpaura.banquepopulaire.fr www.banquepopulaire.fr www.bpaura.banquepopulaire.fr www.ibps.bpaura.banquepopulaire.fr www.icgauth.banquepopulaire.fr

All these cookies remain until the tab on my accounts in the bank is open, but when I close this tab (or go to a completely different domain), they are all deleted by FMN, except those on the exact domain "www.banquepopulaire.fr" that are not deleted, thanks to my rule.

This behaviour is not problematic, and everything works fine.... but I really do NOT understand how it works !

Question 1 : Why all cookies on domain that do not correspond to domain of URL in tab are not considered as "third party" cookies ? Eg. cookies on www.icgauth.banquepopulaire.fr ? I never have had this URL in the tab....

Question 2 : Why, on the other hand, are they deleted when (and only when) I leave the tab with URL https://www.ibps.bpaura.banquepopulaire.fr/ ? When I close this tab, I'm leaving the domain www.ibps.bpaura.banquepopulaire.fr , but AFAI understand, I'm no more / no less in domain www.icgauth.banquepopulaire.fr ... Nevertheless it's only at this time that FMN considers that I have exited this domain, and then deletes relevant cookies....

Once again, I don't say it's not OK, but only that I do not understand.... and would be very happy if some more explanations were provided !

Thanks in advance !

Laurent

PS : Two other questions : What is the exact meaning of the two "global" options

• "Ne jamais nettoyer les domaines sans domaine de premier niveau" (Never clean domains without 1st level domain)
• "Ne jamais lancer de nettoyage sur les fichiers provenant de votre ordinateur" (Never cleanse files coming from your laptop)

1st option is unchecked by default, while the second is checked. I let them so, but I do not understand their purpose.... and they aren't explained in the help page....

[Lusito]

So, there's a lot of questions in here.

This behaviour is not problematic, and everything works fine

So just to be clear, your rule works as you want it to? Not sure if you want the other cookies to remain or get deleted. Your rule should be *.banquepopulaire.fr if you want to protect all of the other subdomains. If you don't have a wildcard in there, only the exact domain will be protected.

Question 1:

Take a look at my explanation about third-party cookies here: https://github.com/Lusito/forget-me-not/issues/38#issuecomment-393300799

Question 2: I'm honestly not sure I get your scenario correctly, but I think when you get the idea about third-party cookies, this one should probably clear up as well.

About the global options, here are the original english translations.. maybe they are not well translated.. I don't know french at all:

• Never clean domains without a Top Level Domain. This is essentially for domains like "localhost", i.e. they don't have a ".com" or similar at the end (mostly used in local networks, like a company intranet).
• Never run cleanup on files from your computer. When you open HTML files, which are stored on your computer (could be help files, or similar) and open them from your filesystem without running a server yourself, then these HTML files can store cookies.

[LaurentGrenet]

Hi, thank you for your answer. It's more clear now. Mainly thanks to your explanation in #38 Nevertheless, to be sure I have exactly understood, let me reformulate below. And thank you in advance to either confirm my understanding is OK.... or to correct me where I'm wrong ! And if by chance my understanding is OK (what I'm almost convinced....), let me suggest to slightly update the help page to replace "Domain" by "First party domain" in at least two places : where is described the cleansing "at exit", and where is described when a cookie is considered as a third party cookie.

Once again thank you for FMN !

============================================================= The list available in https://publicsuffix.org/list/public_suffix_list.dat provides the list of "public suffixes" of internet domains. For a given URL, this list is used to determine which "Public suffix" the URL is relative to, and we call "First party domain" of the URL the domain composed only of the first token after the public suffix (first from right to left). Adding the following tokens (if any) provide the full domain, which is a subdomain of the "First party domain"

In my example above, all the mentioned domains are all subdomains of the same "First party domain", banquepopulaire.fr

A cookie is not considered as "third party" (as I thought previously... after reading the Help page) if its domain is not the domain of any open tab, but if its "First Party domain" is not the "First party domain" of an open tab. As a result, since in my example a tab is open on domain www.ibps.bpaura.banquepopulaire.fr that is a subdomain of "First party domain" banquepopulaire.fr, none of the mentioned cookies (that all belong to a subdomain of this same "First party domain" banquepopulaire.fr) is considered as "third party cookie".

And about the deletion at domain exiting, it actually occurs for all cookies (and/or local storage, etc....) whose "First party domain" is no more the "First party domain" of any open tab. As a result, it is when I close the last open tab whose "First party domain" is banquepopulaire.fr that all cookies relative to this domain, or subdomain of this "First party domain" are deleted (or not, depending on rules). Until there is at least one tab open on any subdomain of banquepopulaire.fr, we are not in "Exit" condition for any cookie belonging to any subdomain of this "First party domain"

[Lusito]

Partially correct. Third-Party is indeed defined by looking at the first-party-domains, but the exit cleanup depends on the cleanup data.

Since localStorage and similar are bound to a subdomain (i.e. can not be accesses by the first party domain or other subdomains), exit cleanup will happen when the subdomain no longer exists. Only cookies can be (in some cases) acessed accross subdomains and thus will only be cleaned when the first party domain no longer exists.

[LaurentGrenet]

Clear. Thank you for answering.