search

mozfreddyb / webext-firstpartyisolation

Enable First Party Isolation Pref
Mozilla Public License 2.0
55 stars 4 forks source link

FPI breaks "Sign in with Amazon" on washingtonpost.com (and others) #8

Open pgarnett opened 6 years ago

pgarnett commented 6 years ago

Subscribers to washingtonpost.com through Amazon (for a hefty discount) must sign in using their Amazon credentials. This addon webext_firstpartyisolation breaks the sign-in process, leaving the subscriber stuck in limbo. Since this addon doesn't appear to have a way to disable it for a single site, I'm forced to disable or uninstall it.

It's otherwise a terrific addon and I'd love to continue using it, but can't in its current form.

mozfreddyb commented 6 years ago

Sorry, but Firefox provides me with a global on/off switch. The granularity of the given API does not allow anyone to write code that would fix your problem.

Unfortunately, the only thing you can do is follow this work-around:

coofercat commented 6 years ago

WIthout wanting to start a "me too" and "+1" storm, but the issue with Atlassian (in #7) means I can't use FPI in my work life because pretty much all of my clients use Jira and/or Confluence.

I can appreciate the FPI plugin can only do what FIrefox allows it to do, and it doesn't allow any site-specific exceptions. I'd be happy to hear how I can help in "adding to the weight" of any request to have Firefox change to support FPI exceptions. To my mind, FPI should be the default behaviour, and to allow exceptions where they are required, so I'd be happy to work towards that goal if it's something worth pursuing.

varjolintu commented 5 years ago

@mozfreddyb Are you certain that this is not possible to do for a single site using browser.tabs.onActivated? I made an experimental extension which uses this for whitelisting.

mozfreddyb commented 5 years ago

As I stated in my previous comment, it might cause a logout on all other tabs: If you disable and re-eanble without interacting with a static website, it can't really notice it. But many front-end heavy websites like Google Docs or Github will disable all links and forms and tell you to re-login because your session has expired (because storage became inaccessible), making all interactions fragile and cause data loss for comments and other unsubmitted data.

I understand this is a trade-off and I'm curious to hear more about your epxerience @varjolintu, but I'm not willing to take the stability risk for this addon for now.

I really think the problem is easier solved with Multi-Account Containers, which allows you to tag cookies not by first-party but by some other label that is both explicitly visible and easily controlled. Multi-Account Containers is made by Mozilla. If you want to discard storage more radically, you might even want to consider Temporary Containers, but I haven't really vetted it.

varjolintu commented 5 years ago

@mozfreddyb Thank you for the reply. I already use both of the container extensions and for now it's good enough. It would be nice if FPI could support exceptions in the future, just like proposed in the earlier messages.

I'm going to make some more testing with my experimental extension and see if any kind of trade-off's exists you mentioned. Anyone else interested can find it here.