Feature request: prevent cookie modification

[znrt22]

Hi,
It would be nice to be able to set cookies to read-only to prevent sites from changing their content.
Right now, protecting cookies from deletion doesn't seem to stop the site from resetting a cookie by changing its value, which kind of defeat the purpose.

[ysard]

Hello, I apologize for the delay in responding, thank you for participating in the project; here are some of the answers that made me leave this question open during this time.

Restoring cookies after deletion is easier than restoring after modification. Indeed, this last requires to keep in memory the entirety of the cookie to be protected (not only its name, but its flags and especially its value).
I do not think CQM is intended to be a copy of the Firefox cookie store. In addition, storing information in several places (the cookie store and the CQM parameters) increases the risks of personal data leakage on the system in case of compromise. The values of cookies are even more sensitive than their name and the url of the parent site.

If Firefox gives me a way to get on the fly the previous state of the cookie that is about to be modified by the site, then I will come back to this idea that I consider admissible :)

Note: From my knowledge of APIs, I note that if an addon offers to preserve a cookie from subsequent changes, it is only a quick rewrite of an older version of the cookie just after the site has been able to make changes (and access them during this short period of time).
It is not a protection stricto-sensu but a bypass of changes made by a website on the data that belong to it.
This is already how the protection against deletion works and this may reduce the interest of the option in some cases.

[znrt22]

Hello, thanks for the insight on the matter. That quick rewrite was indeed what I had in mind, rather than strictly denying modification to the website which would probably be a proper read-only definition, now that I think of it.
Actually, I am already doing that rewrite with CQM, albeit manually, by saving specific cookies in a .json and restoring them once I know the website made some undesired changes.

On a side note, is the protection against deletion supposed to prevent a cookie from being deleted even if the "isSession" flag has been set by the site ? That is actually what is bothering me and made me think about this idea.