search

newinternetlabs / new-internet-extension

https://newinternetextension.com
Other
14 stars 4 forks source link

putFile in blockstack.js stores cookies which triggers "App sent cookies" #10

Open muneebm opened 4 years ago

muneebm commented 4 years ago

The extension triggers "App sent cookies" for xordrive, but the app doesn't use any cookies. When I analyzed further, I noticed that the putFile calls using blockstack.js is setting cookies for some of the calls and that's triggering the "App sent cookies".

Screen Shot 2020-01-05 at 2 12 43 AM

The cookie is being set by Cloudflare, here is more information: https://support.cloudflare.com/hc/en-us/articles/200170156-Understanding-the-Cloudflare-Cookies#12345682

dantrevino commented 4 years ago

I saw this too

larrysalibra commented 4 years ago

Wow that's crazy that Blockstack PBC's gaia hub is setting (Cloudflare) tracking cookies on all requests. They used to be hosted on different infrastructure. Thanks for pointing this out to me!

Perhaps the solution is that for apps that have opted into the sandbox, we shouldn't show this warning because if things are working as they should be, the cookies shouldn't be stored on the user's browser.

It doesn't really matter if servers are trying to set tracking cookies if the extension can prevent them from being set. How does that sound?

friedger commented 4 years ago

:+1: It removes burdens from developer to find CBE compatible hosting services.