SessionStorage partitioning

[bvandersloot-mozilla]

I noticed that there is a behavior gap between WebKit and Gecko on partitioning SessionStorage. Is there a better option between the two we can align on here?

It may be useful to note that this came up while we were prototyping having Storage not un-partition with the Storage Access API. A major IDP uses SessionStorage and relies upon it not being partitioned in some use cases. That means that it is broken with the combination of always partitioned Storage and partitioned SessionStorage.

[miketaylr]

A major IDP uses SessionStorage and relies upon it not being partitioned in some use cases.

Do you have any links to bugs?

[bvandersloot-mozilla]

A major IDP uses SessionStorage and relies upon it not being partitioned in some use cases.

Do you have any links to bugs?

Same issue, different bugtrackers:

• Auth with Redirect Flow does not work with the most recent versions of Firefox firebase/firebase-js-sdk#6443
• https://bugzilla.mozilla.org/show_bug.cgi?id=1780615

[miketaylr]

Thanks - I suppose Chrome will run into that as well when we start to roll out partitioned storage.

[wanderview]

Just to make sure I understand correctly, it seems firebase signInWithRedirect is doing an authentication redirect, but instead of using query parameters to communicate tokens back to the originating site they are instead using a 3P iframe? Flows like OAUTH and OpenId use query params instead IIUC.

[bvandersloot-mozilla]

Just to make sure I understand correctly, it seems firebase signInWithRedirect is doing an authentication redirect, but instead of using query parameters to communicate tokens back to the originating site they are instead using a 3P iframe? Flows like OAUTH and OpenId use query params instead IIUC.

Yes. Specifically they are using SessionStorage which is shared between an embedded iframe and a previous top-level context if not partitioned.

[bvandersloot-mozilla]

@annevk : Do you have a stance on whether SessionStorage should be partitioned?

[wanderview]

My personal take is that we should partition it. As demonstrated by firebase it can be used as a communication channel. We're partitioning other non-persistent communication channels like BroadcastChannel, SharedWorker, etc, so it seems we should partition this one as well.

[johannhof]

@johnwilander do you know if there's documentation (or a prior comment) outlining why WebKit doesn't partition SessionStorage? Would you consider aligning with other browsers in shipping partitioned SessionStorage?

[annevk]

WebKit has addressed this issue some time ago: https://bugs.webkit.org/show_bug.cgi?id=210776. (As far as I can tell my colleagues agree it should be partitioned.)

[bvandersloot-mozilla]

Ah, that is excellent news!

Interesting: I was going off of https://privacytests.org and it looked like Safari didn't partition. Looking at the PR linked in that bug, it landed on Aug 24. Now I look and it is fixed in the Nightly tab on privacytests.org! I'm happy to close this as resolved.