Re: Cookie policies

[Vladimir Sedach <vas@xxxxxxxxxx>]

Boruch Baum <boruch_baum@xxxxxxx> writes:
> 2) I'm not even sure modern browsers even have an option to store
>    cookies to disk *ever*. Should w3m/emacs-w3m continue to support a
>    disk-based cookies file?

Firefox and Chrome both save cookies to disk. Otherwise you would
lose all website settings, logins, and be asked for cookie opt-in
every time you started the browser.

> 4) Emacs-w3m already has certain conditions in which it asks the user
>    whether to accept cookies. Should that be changed to become the
>    default for *all* cookies?

Does emacs-w3m load third party cookies? There would be too many
prompts for third party cookies on some websites. I think rejecting
all third party cookies is the reasonable thing to do. I have been
using Firefox and Chromium with third party cookies disabled since at
least 2018 and have not noticed any problems.

> 5) Modern browsers have begun to automatically delete cookies when
>    leaving a domain, even though the browser process remains. Should
>    emacs-w3m do so? Should the policy be when the current tab exits the
>    domain (strict) or when the last tab exits the domain (lenient)?

Between emacs-w3m and Firefox with μMatrix I find cookie accept
listing to be very convenient. Setting w3m-cookie-reject-domains to
'(".") makes w3m-cookie-accept-domains act as an accept list - you
can specify cookie acceptance per domain like "cliki.net" and for a
domain and all subdomains like ".gnu.org"

Maybe making something that ties into customize-variable to make
cookie whitelisting via w3m-cookie-accept-domains more convenient is
a worthwhile project. Maybe just more visibility/documentation for
that variable is good enough.

> 6) How about adding to the header line of all emacs-w3m buffers a short
>    indication whether that particular page is using cookies? What I'm
>    imagining is to replace the word "Location: " with "URL: ", and
>    prefix it with one of the two unicode cookie emojis (🍪🥠) (C-x 8

That sounds like too much clutter. IMO it would be nice to have
something like w3m-site-information that displays the cookie and TLS
certificate information, similar to what Firefox has.

FYI I am viewing this on a Debian 10.8 installation with the typical
fonts installed, and Emacs cannot find a font to display those
emojis.

--
Vladimir Sedach
Software engineering services in Los Angeles https://oneofus.la