Iridium: First-party isolation blocks PREF cookie

[practik]

TL;DR: It looks like Iridium is unable to set the PREF cookie under FPI because the firstPartyDomain attribute is missing.

1. Install Iridium 1.2.1 in a new Firefox profile with default prefs and no other extensions.
2. Open a YouTube page.
3. Open FF prefs and check site data: It should show that there are 4 cookies for youtube.com.
4. Turn on first-party isolation (go to about:config and toggle privacy.firstparty.isolate to true), then quit and restart FF.
5. Open FF prefs again and clear all cookies and site data.
6. Open the same YouTube page and then check cookies again: This time there will be just 3 for youtube.com.
7. Check the browser console to see the following errors:

cookie is undefined background.js:206
    updateCookie moz-extension://57234747-c43b-cc4c-beab-c9ee06f54842/js/background.js:206
    apply self-hosted:4417
    applySafeWithoutClone resource://gre/modules/ExtensionCommon.jsm:588
    wrapPromise resource://gre/modules/ExtensionCommon.jsm:817
    withLastError resource://gre/modules/ExtensionCommon.jsm:736
    wrapPromise resource://gre/modules/ExtensionCommon.jsm:805

Unchecked lastError value: Error: First-Party Isolation is enabled, but the required 'firstPartyDomain' attribute was not set. background.js:250
    headersListener moz-extension://57234747-c43b-cc4c-beab-c9ee06f54842/js/background.js:250

By installing the Cookie Quick Manager extension and testing again, I was able to see that the cookie that's missing in step 6 is PREF.

[ParticleCore]

This one was quite tricky, there were multiple scenarios to consider and test, that's why it was taking this long to push the fix.

Basically setting the cookie with the Dark theme value on or off was not being done correctly, it was passing more properties than needed.

The url and domain values were also not correct, thus failing for when the YouTube was using http vs https type cookies.

Additionally, because of this setting you detailed, the property firstPartyDomain had to be set with the YouTube domain youtube.com when it was enabled and set to null when disabled, however there's no sync way to check the value of that setting, so the detection runs on extension run when the browser is launched or restarted, which should be OK since it's advised to restart the browser after toggling that setting.

In any case, the issue has been fixed and should no longer cause this problem.

Thanks very much for the lengths you took to explain in detail what was going on, I really appreciate it.

[ParticleCore]

In case any other developer needs the info, this is how you can detect if first party isolation is enabled:

• you need to add the privacy permission to your manifest ( I know, sucks to add it just for this purpose )
• use the following command afterwards:

javascript browser .privacy .websites .firstPartyIsolate .get({}) .then(function (got) { let isFirstPartyIsolateEnabled = got.value; // true => it's enabled // false => it's disabled });