NoScript interfering with Mozilla capabilities policies?
Posted: Thu Feb 11, 2010 7:59 pm
I'm having problems with a default-deny cookie policy at https://club.nintendo.com/ (see for yourself: https://club.nintendo.com/js/clubn-dialogs.do and other JS containing code like:
if (typeof navigator.cookieEnabled == "undefined" && !cookieEnabled)
...which is clearly going to fail with default-deny for cookies (I'm using Cookie Monster to allow per-site). Since I can't make out how to write script surrogates, and gave up on that route, I'm attempting to simply deny usage of the .cookieEnabled property.
This works:
user_pref("capability.policy.default.Navigator.cookieEnabled", "noAccess");
...but if I try to follow the template laid out at http://www.mozilla.org/projects/securit ... olicy.html and set something like this:
user_pref("capability.policy.policynames", "brokencookiedetect");
user_pref("capability.policy.brokencookiedetect.sites", "https://club.nintendo.com/");
user_pref("capability.policy.brokencookiedetect.Navigator.cookieEnabled", "noAccess");
...my prefs.js gains this setting:
user_pref("noscript.policynames", "brokencookiedetect");
...and the policy isn't enforced. Help, please?
(If the best and correct and best path is to set script surrogates, I could use one for https://club.nintendo.com/js/clubn-dialogs.do as well as something involving http://my.monster.com/Login.aspx , which is broken the same way, last I looked.) (I've just been using Chromium instead for Monster. This is my first attempt to outwit witless webdevs who use broken objects like navigator.* for important things, like deciding whether to allow me to log in.)
(By the way, my account, aloishammer, on this forum, ended up disabled while I was trying to change my email address.)
if (typeof navigator.cookieEnabled == "undefined" && !cookieEnabled)
...which is clearly going to fail with default-deny for cookies (I'm using Cookie Monster to allow per-site). Since I can't make out how to write script surrogates, and gave up on that route, I'm attempting to simply deny usage of the .cookieEnabled property.
This works:
user_pref("capability.policy.default.Navigator.cookieEnabled", "noAccess");
...but if I try to follow the template laid out at http://www.mozilla.org/projects/securit ... olicy.html and set something like this:
user_pref("capability.policy.policynames", "brokencookiedetect");
user_pref("capability.policy.brokencookiedetect.sites", "https://club.nintendo.com/");
user_pref("capability.policy.brokencookiedetect.Navigator.cookieEnabled", "noAccess");
...my prefs.js gains this setting:
user_pref("noscript.policynames", "brokencookiedetect");
...and the policy isn't enforced. Help, please?
(If the best and correct and best path is to set script surrogates, I could use one for https://club.nintendo.com/js/clubn-dialogs.do as well as something involving http://my.monster.com/Login.aspx , which is broken the same way, last I looked.) (I've just been using Chromium instead for Monster. This is my first attempt to outwit witless webdevs who use broken objects like navigator.* for important things, like deciding whether to allow me to log in.) (By the way, my account, aloishammer, on this forum, ended up disabled while I was trying to change my email address.)