Cookie blocking in Edge canary does not work

Question

I have the following configured on&nbsp;edge://settings/content/cookies&nbsp;&nbsp;Despite this, the following is from edge://settings/siteData, even after closing and restarting Edge.&nbsp;&nbsp;&nbsp; &nbsp;Does this feature work for anyone?

missyq · Answer

rshupak Hello again, friend! As mentioned here, can you try again since there's been a few updates since you posted? If it still occurs, please try it out in Chrome Canary and then let me know how that works. We'll be able to figure out our next steps from there. 🙂
&nbsp;
Missy Quarry (she/her/hers)Community Manager - Microsoft Edge

rshupak · Answer

MissyQ&nbsp;No change at all.&nbsp; I'm now on&nbsp;Version 81.0.363.0 (Official build) canary (64-bit).&nbsp; Here is an entry under Block on&nbsp;edge://settings/content/cookies&nbsp;&nbsp;And from&nbsp;edge://settings/siteData&nbsp;&nbsp;You can see it fails blocking the host named in settings directly and subdomains.&nbsp;In regard to subdomains, I believe the UI strongly implies that all subdomains of a named domain are covered by the setting.&nbsp; Here is why.&nbsp; This is the Add dialog.&nbsp;Note the wildcard in front of the name.&nbsp; As is, this is ambiguous and could indicate either that a wildcard is permitted or that one is implied.&nbsp; Now, here is the UI when you enter the example&nbsp;&nbsp;You can see that the wildcard is rejected.&nbsp; I just found that the value is accepted with the brackets as shown below.&nbsp;&nbsp;&nbsp; I thought I had tried this long ago and it too failed.&nbsp; I don't know if that was changed or I entered it wrong.&nbsp; I will try this but it is a side issue.&nbsp; The clear evidence that entering "findagrave.com" and cookies for "findagrave.com" not being blocked is an obvious failure.&nbsp; The question of why "http://www.findagrave.com" is not blocked depends on how this undocumented feature is expected to work.&nbsp; It is not documented anywhere that I can find nor is there explanatory text in the UI.&nbsp;

missyq · Answer

rshupak&nbsp;Happy new year! Sorry I did not respond to your follow up earlier. Holidays can cause some craziness here.
&nbsp;
I did receive some more info about ways to add websites to it. It's not the most intuitive thing, and I've relayed that feedback to the team so they are aware this isn't the greatest. Aside from adding in the website using the [*.], you can also add websites using the site permissions settings.
&nbsp;
Click the lock icon up in your URL and select Cookies:

&nbsp;
Click on the domain name you want (the example here is microsoft.com), and then click Block.

&nbsp;
Refresh the page, and go back to the Cookies settings and click the Blocked tab at the top.

&nbsp;
To clear on exit for that specific site, click it and then click Clear Upon Exit. It should show up in your Settings &gt; Site permissions &gt; Cookies and site data under the clear on exit portion now.

&nbsp;
Again, not entirely intuitive, but the team knows that. Hopefully this will help you out in the interim! 🙂
&nbsp;
Missy Quarry (she/her/hers)Community Manager - Microsoft Edge

rshupak · Answer

MissyQ&nbsp;This is just another entry point to the existing UI.&nbsp; The root bug still exists.&nbsp; This UI is also interesting because it doesn't do what you would think.&nbsp; First, using findagrave.com as an example, I have the following configured in the Block section of edge://settings/content/cookies.&nbsp; This is configured to block this host/domain only and not subdomains, i.e. it lacks the [*.] prefix.&nbsp;&nbsp;&nbsp; &nbsp;I now visit I and click on the lock icon to see what cookies were set.&nbsp; Note that it ignores the Block setting and accept cookies anyway.&nbsp;&nbsp;&nbsp; &nbsp;Now for the unexpected, and I believe broken, functionality.&nbsp; If I select http://www.findagrave.com in this dialog then click on block, the following is what gets added.&nbsp; It is curious that it includes subdomains by default when the UI in edge://settings/content/cookies&nbsp;does not.&nbsp; If this behavior is sufficient expected to be the intent that this UI uses it by default, maybe the UI in&nbsp;edge://settings/content/cookies should direct users to this.&nbsp; The broken behavior is that it restricted the block to HTTPS only.&nbsp; I have no reason to expect it to allow cookies over HTTP.&nbsp; It's also curious because the example text in the UI on edge://settings/content/cookies&nbsp;gives no indication that a URL scheme is allowed.&nbsp;&nbsp;&nbsp; &nbsp;Another indication that this is a bug is the behavior when I click on findagrave.com, without the www. subdomain prefix, then the block button, the following is added to the block list on edge://settings/content/cookies.&nbsp; Note that this lacks the HTTPS prefix&nbsp;&nbsp;&nbsp; &nbsp;In summary, the problems are&nbsp;the existing block entry for findagrave.com is not honoredBlocking http://www.findagrave.com adds an HTTPS scheme excluding HTTPThe domain and subdomains are blocked by the addition of the [*.] prefix which is not indicated in the UI and the user is not informed that the block has larger scope than requestedIn regard to the latter, one more flaw.&nbsp; If I remove all the entries for this domain from the block list and visit again, I then selected the findagrave.com entry (without www prefix) first then the Block button.&nbsp; Note that the label "Blocked" was added.&nbsp; It is almost invisible which is a UI flaw but not the issue I am noting.&nbsp; Because the block entry added is for [*.]findagrave.com, it also blocks http://www.findagrave.com which is not labeled as blocked.&nbsp;

Forum Discussion

Cookie blocking in Edge canary does not work

4 Replies

Resources