Third-party Cookie issue

[beardedtechguy]

All of a sudden, about a couple of days ago, it appears that my browsers cookies are being deleted when closing the browser.

I noticed it when have to log into some of my work tools where I have to put in additional fields that are not being auto set, etc. I haven't changed anything on my side and even have cookie exceptions set for these specific site, ex. [*.]example.com.

Anyone know what caused this? It is happening both on the Stable and Snapshot versions.

[Pathduck]

@beardedtechguy What are your cookie settings?

For third-party there's no session only setting, it's only:

Regular (first-party) cookies can be set to Session Only or Blocked.

I noticed it when have to log into some of my work tools where I have to put in additional fields that are not being auto set

I don't understand this, cookies have nothing to do with input fields being populated, unless your tools have special code that gets values from cookies. Usually Autofill is used for input field completion, not cookies.

And why would they be third-party cookies unless they're actually read from another domain?

[beardedtechguy]

@Pathduck I was looking at that.

Originally I had it only blocking in Incognito mode but for some reason it had changed it to Block All. Maybe in a recent update??

I did change it back, so I will check it later.

Also, I did notice there is a section just above this that you can add specific site settings for cookies to allow session only.

[Pathduck]

@beardedtechguy said in Third-party Cookie issue:

Maybe in a recent update??

Vivalid doesn't just change settings, so if it did it might've been a bug, or something you forgot to have changed.

Also, I did notice there is a section just above this that you can add specific site settings for cookies to allow session only.

That's for first-party cookies (and other types of site data), not third-party.

https://en.wikipedia.org/wiki/HTTP_cookie#Third-party_cookie

[beardedtechguy]

Vivalid doesn't just change settings, so if it did it might've been a bug, or something you forgot to have changed.

That's what I meant, sorry. I know I didn't forget to change it. Anyways, it has been changed back and I will keep an eye out to see if any cookies "disappear".

That's for first-party cookies (and other types of site data), not third-party.

I was wondering if that's what it was. I know what first-party and third-party cookies are. I just haven't messed around with those settings to actually "tell" the difference.

Thanks for the help though Pathduck!

[Pathduck]

@beardedtechguy said in Third-party Cookie issue:

I know I didn't forget to change it.

Some "privacy-oriented" extensions like DDG etc might override the browser and change it without you knowing.

Generally, I recommend setting third-party to Blocked.
There's very little point in accepting these cookies, they are mostly used for tracking and ads.

Some (very few) sites might break with third-party blocked, but hardly any these days. I really doubt your site tools rely on third-party cookies.

[beardedtechguy]

@Pathduck said in Third-party Cookie issue:

Some "privacy-oriented" extensions like DDG etc might override the browser and change it without you knowing.

I used to have uBlockOrigin installed and running but recently turned it off. Not sure if it might have jacked with anything.

One thing I am curious about though...if I have it set to block and those site exceptions set for third-party, does those cookies stay? Because it was set that way and I am having to put register my browser each time I access one of my work sites, etc.

I really doubt your site tools rely on third-party cookies.

Unfortunately this is not true. Our MSP tools, well a few of them, I have to register my browser (via a cookie).

[Pathduck]

@beardedtechguy said in Third-party Cookie issue:

One thing I am curious about though...if I have it set to block and those site exceptions set for third-party, does those cookies stay? Because it was set that way and I am having to put register my browser each time I access one of my work sites, etc.

I have not tested this extensively, but it looks like even if your Global cookie permission (for first-party) is set to Session Only, it will still keep first-party cookies for domains you have set third-party exceptions for. Not sure if that's intentional or not, but that's probably some Chromium quirk.

Note that all cookie handling in Vivaldi is all Chromium code, so should work exactly like Chrome and the others.

[beardedtechguy]

@Pathduck said in Third-party Cookie issue:

Note that all cookie handling in Vivaldi is all Chromium code, so should work exactly like Chrome and the others.

I figured as much since Vivaldi is a Chromium browser at heart.

but it looks like even if your Global cookie permission (for first-party) is set to Session Only, it will still keep first-party cookies for domains you have set third-party exceptions for

I can testify that this wasn't working for me as this is what I had it set before.

Another quirk, I have both Stable and Snapshot installed so I will check and see if the settings are set the same. Maybe they are conflicting each other in some way?

[Pathduck]

You'll need to figure out what sort of cookies your sites are actually using, what domains they're from, and verify if they're being saved or not.
If not set your exceptions properly.

I recommend you use the Chromium internal pages to set exceptions so you can use wildcards properly.
Site Data (first-party): chrome://settings/content/siteData
Third-party cookies: chrome://settings/cookies
This is easier if you're used to Chrome settings.

Note that the third-party cookie settings page is kind of broken sometimes, it might show up as blank. If so just go to chrome://settings/ and into Third-party cookies from there.

Note also the wording on the third-party cookies page:
Sites allowed to use third-party cookies.
This was changed several Chromium versions ago, it used to be:
Sites that can always use cookies
Because at the time that page controlled all cookies, not just third-party.

This basically means that if you add [*.]bbc.com to "Sites allowed to use third-party cookies" it will allow all third-party cookies on BBC.
It used to be you could specify explicit exception what sites you wanted to allow third-party cookies from.