I believe this regressed the behavior of exempting sites cookies from being cleared since in newest Firefox versions when configured via policies my allowlist of sites that are allowed to keep cookies now get cleared on exit even though they are exempted.

What policy specifically are you using?

Emma, did any of this change with bug 1767271?

(In reply to Mike Kaply [:mkaply] from comment #1)

What policy specifically are you using?

Emma, did any of this change with bug 1767271?

We've switched from using the "cookie" permission for clear on shutdown exceptions to a new permission "persist-data-on-shutdown". We did migrate existing entries to this new permission here: https://searchfox.org/firefox-main/rev/850e4be1127e6854cfef5be7beeaf4c054ec69a4/browser/components/ProfileDataUpgrader.sys.mjs#1025-1039 However it's possible that migration doesn't work for enterprise policies. How does the mechanism for setting clear on shutdown exceptions work on enterprise policy side? maybe it still sets cookie perms?

Reporter, are you setting exceptions like this currently?

    "Cookies": {
      "Allow": [
        "https://example.com"
      ]
    },

So we need to change this line:

https://searchfox.org/firefox-main/source/browser/components/enterprisepolicies/Policies.sys.mjs#791

addAllowDenyPermissions("cookie", param.Allow, param.Block);

to "persist-data-on-shutdown"?

(In reply to Mike Kaply [:mkaply] from comment #4)

So we need to change this line:

https://searchfox.org/firefox-main/source/browser/components/enterprisepolicies/Policies.sys.mjs#791

addAllowDenyPermissions("cookie", param.Allow, param.Block);

to "persist-data-on-shutdown"?

No, that's most likely not sufficient, because the "cookie" permission still has use beyond clear on shutdown exceptions. It allows to change cookie behavior / capabilities. More likely we want a new policy to control shutdown exceptions separately.

I'm happy to take the bug. I'm currently looking into where the allowlist would fit best. probably somewhere here:

  "policies": {
    "SanitizeOnShutdown": {
      "Cache": true,
      "Cookies": true,
      "History": false,
      "Locked": false
      // exception list here
    }
  }

Bug 1767271 moved clear-on-shutdown exceptions to the persist-data-on-shutdown permission, but the enterprise Cookies policy only writes the cookie permission, so policy-managed allowlists are now cleared on shutdown. Add a SanitizeOnShutdown.Exceptions key that writes persist-data-on-shutdown ALLOW permissions.

I'm surprised we don't have test coverage for this! I'm adding some.

Set release status flags based on info from the regressing bug 1767271

This will fix an old bug - bug 1888541.

(In reply to Emma Zühlcke [:emz] from comment #3)

Reporter, are you setting exceptions like this currently?

    "Cookies": {
      "Allow": [
        "https://example.com"
      ]
    },

Yes that's correct.

https://hg.mozilla.org/mozilla-central/rev/ad01fb232647

Thinking about this, the enterprise migration should have happened. We don't delete these items at shutdown...

(In reply to Mike Kaply [:mkaply] from comment #14)

Thinking about this, the enterprise migration should have happened. We don't delete these items at shutdown...

So what's the issue then and will this fix still work?

So what's the issue then and will this fix still work?

This moves where you set these values to a different policy.

I'm looking into the failure.

How do you have Firefox configured otherwise? Do you have it set to clear history on shutdown but add those sites as exceptions in Cookies?

(In reply to Mike Kaply [:mkaply] from comment #17)

How do you have Firefox configured otherwise? Do you have it set to clear history on shutdown but add those sites as exceptions in Cookies?

Yes I clear everything but allow cookies, also is there supposed to be UI work for this policy because I go to manage exceptions and I dont see the websites anymore (the new policy works though to be clear no longer clearing cookies)

The UI for this is in Preferences->Customize history, clear data on shutdown exceptions (I think)

It won't be there until Firefox 154 though.