cookie dialogues can pile up out of order, but must still be clicked in order

[Scott Dunbar]

Steps to reproduce:
1. Open Firefox with a new profile
2. Set cookies to 'Keep until: "ask me every time"
3. Go to http://community.htc.com
4. Click "Deny" for each request that pops up. Go slow enough that you can see if multiple dialogue boxes pile up.
5. The boxes don't always appear in the same location. When you can see part of a dialogue box behind your current one without dragging it away, click on it.
6. Continue clicking "Deny" in the boxes that are presented to you.

Expected result:
Each cookie is denied in turn.

Actual result:
At some point, you reach a dialogue box where it will not respond. You then need to go back to the one that you skipped (in step 5) and deny that request before you can move on. This can be difficult to find if a lot of requests build up.

This seems pretty contrived, but when you are quickly trying to click through a lot of requests, it can happen unintentionally and without notice.

It might not happen every single time - the changing display location of the boxes seems (to me) to be random, so sometimes you might just get "lucky" and not run into any issues. On this particular site (community.htc.com), the cookie requests seem to be infinite if you don't click "Use my choice for all cookies from this site", so you have plenty of chances to see the problem.

Original report:

If I have the cookies setting "ask me everytime" (Edit->Preferences->Privacy->Accept cookies from sites->Keep until: ask me every time) and I go to a site that sets a bunch of cookies the dialogs to accept/reject the cookies pile up quickly. This in and of itself is a bug as most of the time each dialog asks the exact same question. But the bigger problem is that these dialog boxes must be clicked on *in a particular order* and they get out of order. So I'm stuck with maybe 30 dialog boxes that are all piled up on each other. I have to move them around in order to find the correct one to click on and most of the time give up and kill the browser - which has to be done from the command line since the window kill button must be disabled because of the dialog boxes.

ProblemType: Bug
DistroRelease: Ubuntu 11.04
Package: firefox 6.0+build1+nobinonly-0ubuntu0.11.04.1
ProcVersionSignature: Ubuntu 2.6.38-11.48-generic 2.6.38.8
Uname: Linux 2.6.38-11-generic x86_64
NonfreeKernelModules: nvidia
Architecture: amd64
Date: Thu Aug 25 11:11:17 2011
FirefoxPackages:
 firefox 6.0+build1+nobinonly-0ubuntu0.11.04.1
 flashplugin-installer 10.3.183.4ubuntu0.11.04.1
 adobe-flashplugin N/A
 icedtea-plugin N/A
InstallationMedia: Ubuntu 10.10 "Maverick Meerkat" - Release amd64 (20101007)
ProcEnviron:
 LANGUAGE=en_US:en
 PATH=(custom, user)
 LANG=en_US.UTF-8
 SHELL=/bin/bash
SourcePackage: firefox
UpgradeStatus: Upgraded to natty on 2011-04-30 (116 days ago)

[sciss (sciss)]

User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X; de; rv:1.8.1.14) Gecko/20080404 Firefox/2.0.0.14
Build Identifier: Mozilla/5.0 (Macintosh; U; Intel Mac OS X; de; rv:1.8.1.14) Gecko/20080404 Firefox/2.0.0.14

With preferences set to "accept cookies" / "always ask", certain sites produce an infinite loop of cookie permission dialogs, despite having "remember this decision" checked (note: i'm running firefox in german, so the exact text / gadget labels might be different in english firefox).

Reproducible: Always

Steps to Reproduce:
1. Flush cookies (Delete private data)
2. Set prefs to "accept cookies" / "always ask"
3. Clear the list of cookie exceptions in the preferences (remove all sites)
4. Quit and restart firefox
5. Go straight to http://www.nabble.com/SuperCollider-f2891.html
Actual Results:
The cookie permission requester dialog pops up (see first attached screenshot). Independant of the choices, even when "remember decision" is checked, the dialog pops up again and again. After some dozen repetitions, a distorted dialog pops up (see second attached screenshot) that doesn't respond at all. Need to force-quit firefox, but problem reoccurs upon next start, sometimes disappears when accessing the site differently (e.g. as a link from google results).

Expected Results:
Firefox should store my cookie preferences for that site and the dialog should not pop up again if "remember decision" is checked.

Mac OS 10.4.11, German, Intel Core Duo

[sciss (sciss)]

Created attachment 316785
screenshot of the looped dialog

[sciss (sciss)]

Created attachment 316786
Distorted dialog after some dozen repeats of the normal dialog

[sciss (sciss)]

Created attachment 316787
cookie prefs settings

[Uliss (uliss)]

Mozilla/5.0 (Macintosh; U; PPC Mac OS X 10.5; en-US; rv:1.9) Gecko/2008052903 Firefox/3.0

Confirmed on this build exactly as indicated
Sometimes you can get 3 or more of the cookie permission requester dialog pop ups to occur even though you click the remember box and click the allow button
- confirm that the "nabble" web site is allowed by the following steps - Firefox -> Preferences -> privacy tab -> click show cookies button - observe nabble web site in the window

[Markus Fischer (markus-fischer)]

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.2) Gecko/20090729 Firefox/3.5.2

Confirmed exactly as indicated, too.

[David Lang (david-lang)]

User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.0.14) Gecko/2009090217 Ubuntu/9.04 (jaunty) Firefox/3.0.14
Build Identifier: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.0.14) Gecko/2009090217 Ubuntu/9.04 (jaunty) Firefox/3.0.14

if a site sets many cookies and you have firefox set to 'ask' each cookie generates a seperate popup window, and even if you give an answer that applies to all cookies from that site, you still have to repeat the process for each cookie

Reproducible: Always

Steps to Reproduce:
1.set prefrences to ask for cookie approval
2.browse to a site that sets multiple cookies (especially one with many elements in the page, each of which sets a cookie)
3. hit the checkbox to apply your decision to all cookies from that domain and select a result (approve, deny, or only for session)
Actual Results:
many popups that must be answered individually

Expected Results:
if you select apply to all cookies for this site, all the extra windows should go away. or you could present all the cookies for a page or site in a single popup so that they can be approved/denied individually, or all approved

[David Lang (david-lang)]

note that this is very similar to bug 516221, just with cookie approval popups instead of auth popups

this includes the problem that these popups must be dealt with in order, and if there are a lot of them it's not unusual for them to get out of order so I have dozens of popups that I have to drag around to get them out from overlapping each other, then just click all of them to find out which one wants attention next and keep repeating the process until they are all dealt with.

[David Lang (david-lang)]

that bug was marked as s duplicate of 339804, all the same problems reported there apply

[Elusis (elusis)]

I am having this problem as well. FF 3.6.3 on a MacBook with no theme installed. Catalogchoice.org is a site where I recently had this happen. Ticketfly.com is another. I accept a cookie for a site with "use my choice for all cookies from this site" checked and yet I get dialog box after dialog box from the same site requesting permission to set cookies. Same thing happens if I deny permission to set the cookie with "use my choice for all cookies from this site" ticked. Some commercial sites with a lot of ad beacons and third party cookies require a dozen clicks or more to dismiss all the boxes coming from just a single domain.

[Elusis (elusis)]

This problem is still ongoing for me - other problematic domains include cnn.com, oprah.com, and many shopping sites.

[Dchubrick (dchubrick)]

This bug is still around in Pre7:

Here's my crash report: 126b16ad-379a-4175-af14-bd6622100912

(saw a bug report somewhere off of this but can't find it, but someone also reported same issue at same site: Bug 597325

[Timeless-bemail (timeless-bemail)]

*** Bug 597325 has been marked as a duplicate of this bug. ***

[Realgrouchy (realgrouchy)]

I thought there was an existing bug asking for an option "apply my decision to all cookies on this page"; however, I cannot find it right now. That would be a suitable solution to this bug.

[Markus Fischer (markus-fischer)]

I haven't seen this problem since FF4 betas. However nabble.com (link from Comment #1) has changed (I think), so maybe that's also a cause. I can't say.

[Dchubrick (dchubrick)]

Created attachment 509834
Cookie Prompt Stuck - Seperation and #ing of boxes

[Dchubrick (dchubrick)]

I haven't had any crashes although I've been mostly been using my regular profile as of late so things are already set so unless I go someplace new...

However, I switched to my beta testing profile to see if I could find a site to try and crash the browser.

I didn't have any luck with the catalog site or oprah.com.

However, and I don't know if I should file a separate bug or keep it here.

When you get a multitude of popup boxes for the cookies. It will appear you are stuck and you can't clear them anymore. I finally investigated it today and findings were a little funny. I knew that you had to clear what appears to be older popup boxes (were under the box that you were stuck on). I thought it had to be for the same domain to clear it. It wasn't.

I tested at cnn.com. I uploaded a screenshot of the cookie prompt boxes from where it got 'stuck' when I was clearing them out. See 'Cookie Prompt Stuck'

#1 is the prompt I was stuck at that refused to clear out no matter what button I pressed or trying to close it. It just stayed there. Each subsequent box underneath is numbered sequentially (2,3...).

At #4 or #6 was when I was able to clear out #1. I initially thought I had to clear out previous boxes with the same domain, but 4 and 6 are ads.cnn.com as you can see. After clearing #2 and #3, I still was NOT able to get rid of that box. Because I thought it was an issue with the domain name as noted, I didn't check beyond that till I hit #5.

Note, I wasn't sure how many boxes I had so I was playing around with laying them out to #4 and #6 might be reversed.

Needless to say, it is rather odd behavior. I'm not a developer, but I really think Mozilla should rethink the way cookies are handled. The end-user shouldn't have to sacrifice sanity for privacy handling. It's a big turn-off.

One other annoying thing, and this might be a separate bug is that some sites while trying to send the cookies think cookies are off and tell you that you need your cookies are on. Bestbuy.com USE TO require cookies to browse their site. I don't have another site offhand for testing purposes of this.

[Elusis (elusis)]

It's funny, I hadn't had this happen in months, then I got this update, and literally 12 hours later this issue took my whole browser down. I was trying to get a connection going at a Hyatt hotel, which redirects any queries to their provider in order to charge you fees before setting a cookie to allow you through. Their provider site originally crashed me with this "infinitely spawning cookies" problem - gateway.eagle_shs.com.

[Nico R. (n-roeser)]

I think this bug is related to bug 515521 and/or bug 434971.

[KK (kk1986-deactivatedaccount)]

Scott,

Can you give an example of a website where this happens? I have visited a site where I get lots of cookie popups before (which is annoying), but I have never had problems with them being out of order.

Thanks

[KK (kk1986-deactivatedaccount)]

I actually just had this happen to me in the course of normal browsing. I was doing something at htc.com, but I wasn't looking for this at the time so I don't know exactly what I did to make it happen. I'll try to come up with steps to reproduce.

[KK (kk1986-deactivatedaccount)]

The "out of order" aspect of this mentioned in comment 1 is pretty easy to run into on Ubuntu, as the dialogue boxes don't accurately stack on top of each other.

Related bug in Ubuntu: https://bugs.launchpad.net/ubuntu/+source/firefox/+bug/833952

[KK (kk1986-deactivatedaccount)]

This bug has previously been reported upstream: https://bugzilla.mozilla.org/show_bug.cgi?id=516224

[Mozilla-bugs-a (mozilla-bugs-a)]

This bug looks like a duplicate of bug 648609. Can someone with the needed bugzilla permissions mark it as such, please?

[ashughes (anthony-s-hughes)]

*** This bug has been marked as a duplicate of bug 648609 ***

[Gerardo Lisboa (gvlx)]

Still happening on *all* platforms.

Verified also on:
Name: Firefox
Version: 7.0.1
User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.5; rv:7.0.1) Gecko/20100101 Firefox/7.0.1

[Elusis (elusis)]

I'm at 8.0.1 for Mac and this is still going on. I'm stunned.

[Bugcuddler (bugcuddler)]

Reproduced:
Mozilla/5.0 (X11; Linux x86_64; rv:13.0a1) Gecko/20120212 Firefox/13.0a1

New test URL: http://www.masterfile.com/stock-photography/search/Greg+Stott

[Bugcuddler (bugcuddler)]

*** Bug 648609 has been marked as a duplicate of this bug. ***

[Bugcuddler (bugcuddler)]

*** Bug 726558 has been marked as a duplicate of this bug. ***

[Bugcuddler (bugcuddler)]

This bug should be moved the an appropriate product / component since it's kinda invisible in Firefox / General.

[Bzbarsky (bzbarsky)]

This is a Firefox bug. The "always ask" setting is not supported; the bug is that Firefox allows it to be set in the first place.

[Zombi (zombi)]

The bug is to always show one dialog at most, and if 'remember decision' is checked, then re-evaluate, that it is appropriate to ask the same question again.

[Markus Fischer (markus-fischer)]

(In reply to Boris Zbarsky (:bz) from comment #19)
> This is a Firefox bug. The "always ask" setting is not supported; the bug
> is that Firefox allows it to be set in the first place.

Does this suggest to remove this feature completely?

[Bzbarsky (bzbarsky)]

If you want a browser that doesn't malfunction and crash, yes.

[Zombi (zombi)]

(In reply to Boris Zbarsky (:bz) from comment #22)
> If you want a browser that doesn't malfunction and crash, yes.

Better: the whole networking code should be removed, so we wont get any cookies over the network

[Markus Fischer (markus-fischer)]

(In reply to Boris Zbarsky (:bz) from comment #22)
> If you want a browser that doesn't malfunction and crash, yes.

Thanks for clarification. It's interesting, because this very feature is one of *the* reason for me to use FF (and this since 1.0 came out): it's one of the few things really giving me the sense of being in control and allowing me decide in time, what gets stored and what not.

[Shtrom-mozilla (shtrom-mozilla)]

“Always ask” is a great feature. I don't want cookies from sites that don't actually need it to work, nor from sites I'm not actually visiting. Please don't remove this feature.

That said, the multiple windows issue happenned again just happened to me again with FF 12 (see screenshot; note the repeated content on some of them).

One thing which makes the thing worse with all these dialogs is that the last one becomes modal for all the rest. So they have to be clicked in exactly the reverse order of when they appeared. Considering the attached screenshot (there actually are several layers, all for the same domain), this becomes so messy that killing firefox after having made the choice for the topmost window (once found) one and checked “Use [...[ for all” is more efficient.

[Shtrom-mozilla (shtrom-mozilla)]

Created attachment 620190
This is a bit overwhelming

[Shtrom-mozilla (shtrom-mozilla)]

Created attachment 620191
Proposed mock up for a better cookie-managing UI

I already posted this mock up for #648609, but this bug seems to have become the official one, so here it is again.

This mock up proposes an UI consitient with most of Firefox's now per-site interaction (location, password, ...), by showing all the cookie requests that need be addressed for that page to load, but putting everything nicely in a tree-like view similar to the cookie manager.

[Ron Wolf (ron-e-wolf)]

Apologies if this is not the proper kind of message to leave here, I want to put in a plea for addressing this problem. Being able to choose which cookies to accept (or not) is an important privacy feature and one that, as a user, I've invested a lot of time in. In the course of web use, I have accepted thousands of cookies and rejected thousands more. I'm not the only one, many friends and co-workers also go thru this pain in order to preserve some semblance of privacy while also being able to interact successfully with the many websites that have become an essential part of our lives.

But the irritation of using this feature in its current half-implemented form, is torture. For instance, every time I start FF, it asks about the doubleclick.com cookie and every time, I click to not accept and the "remember decision" is clicked. Yet FF asks me the next time FF is started. Its not just doubleclick.com, this happens for every website I use. "remember decision" seems to be just for the current session. well, not even that, because sometimes i get asked even for cookies from sites that i've already responded to in the current session.

and yes, the multiple pop-ups for multiple cookies from the same site (which is what i think this bug report specifically addresses) is beyond annoying.

i'm sure that this is not easy to address, requiring a new interface and perhaps a new model. but pls do this as my other options are to accept all cookies (NO!) or try another browser. as a devoted FF user, i don't want to do that. not clear that other browsers do much better at this anyway...

[Markus Fischer (markus-fischer)]

(In reply to Ron Wolf from comment #28)

I've been using this dialog since , I guess, five or more years (feels to me like I've always used it, don't know). It brought me great awareness but also annoyance.

I switched my mentality: don't accept cookies, unless required. By using https://addons.mozilla.org/en-US/firefox/addon/cookie-controller/ , I'm able place easy accessible buttons which allow me to a) enable it for session only or persistently and b) easily allows me removing site-specific or all session cookies.

I don't operate on Dialogs with this add-on but only on the icons in my toolbar. YMMV. HTH

[D. Hugh Redelmeier (hugh-mimosa)]

I'm getting a particularly frustrating variant of this problem with firefox 17.0 on 64-bit Fedora 17 Gnome.

I get a stack of these cookie confirmation dialog boxes and I wish to click "allow for Session" on each of them. The top of the stack won't take a click! If I drag the FF window, some of the stack of dialog boxes moves, and some doesn't. Then, at least one of the visible boxes can be clicked and dismissed.

Observation 1: the biggest surprise is that the box that I can click after this maneuver seems to have the same contents as the former top box that was unresponsive. I wonder if the display was not correctly rendered before the maneuver.

Observation 2: if the cookie dialog box were not modal (is that the correct term?) and each of them would take clicks at any time, the order of the stacking would not be so critical.

Right now, I feel like I'm in a game of Adventure (twisty little passages, all alike) and I don't want to be.

[D. Hugh Redelmeier (hugh-mimosa)]

See also https://bugzilla.mozilla.org/show_bug.cgi?id=633763 "Cookie confirmation dialogs should be tab-modal"

[Ron Wolf (ron-e-wolf)]

(In reply to Markus Fischer from comment #29)
> (In reply to Ron Wolf from comment #28)
>
> I've been using this dialog since , I guess, five or more years (feels to me
> like I've always used it, don't know). It brought me great awareness but
> also annoyance.
>
> I switched my mentality: don't accept cookies, unless required. By using
> https://addons.mozilla.org/en-US/firefox/addon/cookie-controller/ , I'm able
> place easy accessible buttons which allow me to a) enable it for session
> only or persistently and b) easily allows me removing site-specific or all
> session cookies.
>
> I don't operate on Dialogs with this add-on but only on the icons in my
> toolbar. YMMV. HTH

Marcus,

Thank you for the pointer to cookie-controller, much better!!! Almost good enough. Don't know why I didn't think to look for an add-on, maybe assumed that cookie mgmt is a core browser function and didn't think "add-on". Anyway, thx!!!

So then two additional comments:

1) The cookie-controller add-on is SO MUCH BETTER than FF's built-in cookie mgmt that I suggest dropping the idea of fixing FF's built in function and instead incorporate cookie-controller in the mainstream release. If you like, I'll generate a long list of how cookie-controller add-on is better.

2) I don't find the essential and documented "same as the previous session" cookie controller option. Marcus? Do you see this option? Maybe I'm just missing it???

[Ron Wolf (ron-e-wolf)]

(In reply to D. Hugh Redelmeier from comment #30)
> I'm getting a particularly frustrating variant of this problem with firefox
> 17.0 on 64-bit Fedora 17 Gnome.
>
> I get a stack of these cookie confirmation dialog boxes and I wish to click
> "allow for Session" on each of them. The top of the stack won't take a
> click! If I drag the FF window, some of the stack of dialog boxes moves,
> and some doesn't. Then, at least one of the visible boxes can be clicked
> and dismissed.
>
> Observation 1: the biggest surprise is that the box that I can click after
> this maneuver seems to have the same contents as the former top box that was
> unresponsive. I wonder if the display was not correctly rendered before the
> maneuver.
>
> Observation 2: if the cookie dialog box were not modal (is that the correct
> term?) and each of them would take clicks at any time, the order of the
> stacking would not be so critical.
>
> Right now, I feel like I'm in a game of Adventure (twisty little passages,
> all alike) and I don't want to be.

Yes, this is the bug that is being complained about here. Nasty. Suggest you take Marcus' (as I have) and install the https://addons.mozilla.org/en-US/firefox/addon/cookie-controller/ add-on.

[Astrobill1968 (astrobill1968)]

This bug has been around for four years....it's KILLING me. I'm having to Force Close Firefox in Mac OS X about once every two dozen websites or so. Why isn't this a more major bug and why isn't this fixed yet?

[Bzbarsky (bzbarsky)]

See comment 19.

[airdrummer (air-drummer)]

Created attachment 751675
blank cookie dialog

[airdrummer (air-drummer)]

(In reply to tom wible from comment #36)
> Created attachment 751675
> blank cookie dialog

this also locks the associated window.

i have also experienced the looping dialogs, which occasionally are infinite.

[sciss (sciss)]

I can't believe no one could fix this problem in 5 (!) years, from Firefox 5 through 22 (= 17 major versions).

http://apple.com

-> images.apple.com cookie dialog hangs forever. re-starting FF does _not_ help.

In other words, not possible to see Apple website in Firefox with custom cookie permissions.

-----

{
  "application": {
    "name": "Firefox",
    "version": "22.0",
    "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:22.0) Gecko/20100101 Firefox/22.0",
    "supportURL": "http://support.mozilla.org/1/firefox/22.0/Darwin/en-US/"
  },
  "modifiedPreferences": {
    "accessibility.typeaheadfind.flashBar": 0,
    "browser.cache.disk.capacity": 358400,
    "browser.cache.disk.smart_size.first_run": false,
    "browser.cache.disk.smart_size.use_old_max": false,
    "browser.cache.disk.smart_size_cached_value": 358400,
    "browser.history_expire_days.mirror": 180,
    "browser.places.importBookmarksHTML": false,
    "browser.places.smartBookmarksVersion": 4,
    "browser.search.suggest.enabled": false,
    "browser.search.update": false,
    "browser.search.useDBForOrder": true,
    "browser.startup.homepage_override.mstone": "22.0",
    "browser.startup.homepage": "about:home",
    "browser.startup.homepage_override.buildID": "20130618035212",
    "dom.w3c_touch_events.expose": false,
    "dom.mozApps.used": true,
    "extensions.checkCompatibility.8.0": false,
    "extensions.checkCompatibility.5.0a": false,
    "extensions.checkCompatibility.5.0b": false,
    "extensions.checkCompatibility.3.6pre": false,
    "extensions.checkCompatibility.4.2pre": false,
    "extensions.checkCompatibility.7.0": false,
    "extensions.checkCompatibility.4.0pre": false,
    "extensions.checkCompatibility.11.0": false,
    "extensions.checkCompatibility.nightly": false,
    "extensions.checkCompatibility.6.0a": false,
    "extensions.checkCompatibility.3.6": false,
    "extensions.checkCompatibility.4.2a": false,
    "extensions.checkCompatibility.10.0a": false,
    "extensions.checkCompatibility.4.2": false,
    "extensions.checkCompatibility.10.0": false,
    "extensions.checkCompatibility": false,
    "extensions.checkCompatibility.8.0a": false,
    "extensions.checkCompatibility.12.0a": false,
    "extensions.checkCompatibility.9.0a": false,
    "extensions.checkCompatibility.3.7a": false,
    "extensions.checkCompatibility.6.0": false,
    "extensions.checkCompatibility.9.0": false,
    "extensions.checkCompatibility.4.2p": false,
    "extensions.checkCompatibility.4.2b": false,
    "extensions.checkCompatibility.4.0": false,
    "extensions.checkCompatibility.7.0a": false,
    "extensions.checkCompatibility.12.0": false,
    "extensions.checkCompatibility.11.0a": false,
    "extensions.checkCompatibility.3.6b": false,
    "extensions.checkCompatibility.5.0pre": false,
    "extensions.checkCompatibility.4.0p": false,
    "extensions.checkCompatibility.4.0b": false,
    "extensions.checkCompatibility.3.6p": false,
    "extensions.checkCompatibility.5.0p": false,
    "extensions.checkCompatibility.5.0": false,
    "extensions.lastAppVersion": "22.0",
    "font.internaluseonly.changed": false,
    "gfx.blacklist.webgl.msaa": 4,
    "netw...

[sciss (sciss)]

Actually first reported is FF 2, so the bug survived through 20 major versions.

[Deletesoftware+moz (deletesoftware+moz)]

*** Bug 770978 has been marked as a duplicate of this bug. ***