Is there possibility to block third party cookies (block cross site tracking cookies and isolate other cross site cookies)

[marcinkosztolowicz]

Is there possibility to block third party cookies (block cross site tracking cookies and isolate other cross site cookies)

[aartaka]

Third party cookies are disabled by default. You can configure/force the behavior with

(define-configuration :browser
  "Forcing the no third party cookie behavior. 
Other options are: 
:NEVER to store no cookies at all.
:ALWAYS to accept all of them :/"
  ((default-cookie-policy :no-thirt-party)))

We also have enabled WebKit Intelligent Tracking Protection by default. Which is Apple's machine learning thingie trying to guess which websites need cookies and which should be blocked to hell. But this ITP thing is a black box, so no comments there.

Documentation is lacking, yes.

[aadcg]

@marcinkosztolowicz you can get the documentation for this slot by invoking the describe-slot command (via Ctrl-Space) and typing default-cookie-policy.

[aadcg]

nyxt:describe-slot?class=%1Bbrowser&name=%1Bdefault-cookie-policy

[marcinkosztolowicz]

@aadcg That was my first impression. I tested it with youtube as an third party and I thought that firefox handles it as I expected which is isolate or block those youtube cookies. I investigated it further and it looks like firefox does not block or isolate this youtube cookies so behavior is more or less similar to nyxt with :no-third-party configuration.
I've also checked it with other cookies (probably from advertisers) and it looks like there are blocked as intended.
I am wondering why youtube cookies are not treated as third party cookies.

To sum up. From nyxt perspective it is as good as firefox (with less configuration options in nyxt, but this is not the topic of this issue)

[aadcg]

CC @aartaka.

[jmercouris]

We could also post a Nyxt url to the page :-O

[marcinkosztolowicz]

Thank you for your answers! it was really informative. I hope maybe it will help someone in future, when she will search issues on github :)

One thing is bothering me and I have some further questions.
I want to apologize if I do not understand some concepts behind blocking third party cookies.

What I observer
I can see cookies for third party site like youtube on different site where youtube video is embedded.

What I would like to have
At least I would like to have cookies with different user identification or even better to not have this third party cookies set.
(this is what firefox have)

How to reproduce

1. open Nyxt, go to youtube, open developer tools (function: open-inspector), checkout youtube cookies (eg, VISITOR_INFO1_LIVE)

2. open new tab and go to site with embedded youtube video (eg. https://punchsalad.com/tutorials/embed-youtube-video/ in this example you need to click play on video)
3. checkout cookies, eg, VISITOR_INFO1_LIVE have the same value as in first point

[aadcg]

@marcinkosztolowicz it seems that what you're saying is that setting default-cookie-policy to :no-third-party (the default) does not work as advertised. In other words, it's a bug. Is that correct?