noscript
noscript copied to clipboard
hackademix
[Firefox Android] Temporary permissions not cleared after browser exit
Noscript version 11.2.3, Firefox is fennec from fdroid version 85.1.3 but shoud not be different than mainline FF. By exit I mean actually closing browser with "quit" button from menu. Then after launch all temporary rules are still there.
Is this bug or limitation of mobile version?
It's working as expected for me. I had a hard time to find any "quit" button in the menu (I didnt, in facts: could you send me a screenshot?), and I even installed Fennec from FDroid to be sure it wasn't a build-specific issue, but if I:
- Install NoScript 11.2.3 on a clean profile
- Open https://maone.net and set it to "temp Trusted"
- Verify scripts are allowed (my email address is displayed in clear on the top right)
- quit the browser by swiping it out from the task manager
- Reopen Fennec
I can see https://maone.net is no more TRUSTED (it's back to DEFAULY) and scripts are not running.
The same happens if I forcibly kill the application, because temporary permissions are not "cleared" on exit, they're just stored in volatile variables and never touch permanent storage.
All right, I confirm that swiping browser off task manager revokes permissions.
To quit button appear you need first check "delete browsing data on quit" in privacy and security settings. I use it to clean history, cookies etc and then permissions remains. Like NS is not detecting exiting that way?
To quit button appear you need first check "delete browsing data on quit" in privacy and security settings. I use it to clean history, cookies etc and then permissions remains. Like NS is not detecting exiting that way?
No, it's more like Firefox is "faking" a quit by just erasing cookies and closing the tabs, while keeping the browser (and its extensions) actually running. I'm not sure there's a way for WebExtensions to detect this is happening and erase their browsing history related data (which would be the right thing to do).
I'd open a bug on Mozilla's bug tracker for this, asking if such a way exists or, if it doesn't, advocating for the browser calling browser.runtime.restart() on each installed extension when it performs this fake quit, which I believe would be the best, because it wouldn't involve any additional work on behalf of all the affected extensions.
As a work around for you, I suggest to use Private Window instead of this "hack".
Ah I see, was suspecting something like that happens after your first post. Well, thanks for quick answers and have a nice day.