arkenfox / user.js

Firefox privacy, security and anti-tracking: a comprehensive user.js template for configuration and hardening
MIT License
9.43k stars 507 forks source link

ToDo: work out WTF this all means and fixup if required #1853

Closed Thorin-Oakenpants closed 2 weeks ago

Thorin-Oakenpants commented 3 weeks ago

some original comments

which I removed in an upcoming PR

Thorin-Oakenpants commented 3 weeks ago

cc @Jee-Hex

OK, I remember now - the key is the diff between Allow for session and Allow and all that context was kinda missing

so something like this, but we will condense it :)

/* 2815: set "Cookies" and "Site Data" to clear on shutdown (if 2810 is true) [SETUP-CHROME]
 * [NOTE] Exceptions: A "cookie" permission controls "offlineApps" (see note below). If you set a
 * site exception for "cookies", either "Allow" (default) or "Allow for Session", then "offlineApps"
 * are enabled for that site, except shared/service workers where the exception must be "Allow".
 * [NOTE] Keep logins: For cross-domain logins, add exceptions for both sites
 * e.g. https://www.youtube.com (site) + https://accounts.google.com (single sign on)
 * [NOTE] "offlineApps": Offline Website Data: localStorage, service worker cache, QuotaManager (IndexedDB, asm-cache)

to

 * [NOTE] Exceptions: A "cookie" permission controls "offlineApps" (see note below), of which
 * Service Workers require an `Allow` permission to function.

maybe :) we can probably do better, plus we better retest

edit: PS: great detective work @Jee-Hex 🍻 🐈 🍕

Thorin-Oakenpants commented 2 weeks ago

so I added https://arkenfox.github.io to site exceptions as Allow for Session and ran TZP

tzp

Now the (web and shared and) SW I'm only testing that they pass a message. So to function is not the right word. I'll see if I can find a test site for workers "storage"

Thorin-Oakenpants commented 2 weeks ago

blocked, for comparison

blocked

cookies, localStorage, sessionStorage, IDB all fail or error out - I am testing setting some storage and then reading it back - both session only and persistent, except IDB which is persistent.

cache, shared workers, service workers, and file system all error out

Thorin-Oakenpants commented 2 weeks ago

how to build a test for it : https://medium.com/dev-channel/testing-service-workers-318d7b016b19

Thorin-Oakenpants commented 2 weeks ago

STR

okie dokie, so seems as if this allow for session is fine

okie dokie