I don't know anything about the dFPI rollout plans or schedule, but the network.cookie.thirdparty.sessionOnly and network.cookie.thirdparty.nonsecureSessionOnly code was a prototype that was never enabled. I don't think there's any reason to postpone removing the code.

Flags: needinfo?(cpeterson)

👁 Image	jscher2000
	Comment 3 • 4 years ago

(In reply to Simon Mainey from comment #1)

thoughts? third party with dFPI isn't really a third party any more, so maybe do this after the dFPI rollout?

Is this the dFPI which is part of "Strict" mode Tracking Protection, or something new/enhanced?

(In reply to Chris Peterson [:cpeterson] from comment #2)

... the network.cookie.thirdparty.sessionOnly and network.cookie.thirdparty.nonsecureSessionOnly code was a prototype that was never enabled.

Coincidentally, a Mozilla Connect post recently suggested making these preferences more visible. But if they don't work...

👁 Image	Thorin [:thorin] Reporter
	Comment 4 • 4 years ago

(In reply to jscher2000 from comment #3)

Is this the dFPI which is part of "Strict" mode Tracking Protection, or something new/enhanced?

Bug 1731713 - Total Cookie Protection into standard mode is how I read it. Strict has extra features Standard doesn't

👁 Image	Thorin [:thorin] Reporter
	Comment 5 • 4 years ago

(In reply to jscher2000 from comment #3)

Coincidentally, a Mozilla Connect post recently suggested making these preferences more visible. But if they don't work...

I think they work, they were just never flipped on - nonsecureSessionOnly was added in FF58 to give an idea of time. Removing them should simplify code, reduce any footguns and complexity, and present a unified message. Note: sites can still set session cookies, so IDK if that solves all of those "hacky" session workarounds

So the question really is, debunk the false dichotomy of that Mozilla Connect post (i.e it's not really third party anymore if it's partitioned) and remove. Or don't and start flipping them. Dead code is dead if it's never going to be used (by 99% of users)

👁 Image	Emma Zühlcke [:emz]
	Comment 6 • 4 years ago

I think there is an argument, beyond dFPI / TCP for making third-party cookies session bound. dFPI prevents third-parties from tracking you across different top-level sites, but it still allows for persistent storage. However, like with Bug 1681493 I suggest to use sanitize-on-shutdown instead.
If these prefs were at no point exposed via UI or enterprise policy / extension API it should be safe to remove them.

👁 Image

Kershaw Chang [:kershaw]