Cookies exceptions whitelisting not working

cafevincent · Unread post by **cafevincent** » 2024-11-04, 11:41

Operating system: Windows 11
Browser version: 33.4.0.1
32-bit or 64-bit browser?: 64-bit
Problem URL: All
Browser theme (if not default): Dark Moon 2.7.2
Installed add-ons: 11 but all disabled
Installed plugins: (about:plugins): none

If possible, please include the output of help->troubleshooting information (as text):

I found this browser because it seems to be the only way to refuse all cookies with a whitelist, except that I can't get it to work. I have "allow sites to store cookies and data" set to disabled, and only the sites I want to log in to set to "allow for session" in exceptions, like "imdb.com". I have plenty of sites in the whitelist, but none are saving any cookies so I can't log in anywhere, forcing me to use an other browser as a playground for those sites. I am desperate to figure this out. It does not matter if I have "always use private browsing mode" on or not, the cookies still refuse to appear.

suzyne · Unread post by **suzyne** » 2024-11-05, 03:46

I don't have an answer, but instead an additional question related to this because I wonder what "exact address" means?

Does this mean identical in full, or is it just the base URL? In other browsers, I have noticed that a wildcard can be included for exceptions. But in Pale Moon it is not clear to me how it works. (And sorry, I haven't taken the time to experiment, to try and figure it out.) For example, if I add:

https://imdb.com/

as an Allow exception, does that include any data or cookies stored for:

https://m.imdb.com/

Or is that not how cookies work? I am wondering if this might be related to the original question of why a whitelist doesn't appear to be working?

Unread post by **moonbat** » 2024-11-05, 04:40

suzyne wrote: ↑
2024-11-05, 03:46
Does this mean identical in full, or is it just the base URL?

The former.

suzyne · Unread post by **suzyne** » 2024-11-05, 05:21

When I sign into Outlook the URL of the login page is https://login.live.com/ but once I am in Outlook proper the web page is https://outlook.live.com/ so I wonder if both would need to be added as Allows so that I stay logged in when using a whitelist? Because if it is identical in full then https://live.com/ wouldn't be sufficient?

I think in Edge I put something like [*.]live.com and that covers everything.

Unread post by **moonbat** » 2024-11-05, 06:30

I went through my exception list and seems you're right, the base domain suffices. I only have one entry for live.com and google.com and have no problems signing into either.

kreemoweet · Unread post by **kreemoweet** » 2024-11-05, 06:55

cafevincent wrote: I have "allow sites to store cookies and data" set to disabled, and only the sites I want to log in to set to "allow for session" in exceptions, like "imdb.com". I have plenty of sites in the whitelist, but none are saving any cookies so I can't log in anywhere

Just allowing session cookies would not allow for preserving login information. By definition, session cookies are discarded when the browser is closed.
Automatic logins require persistent (non-session) cookies. Your logins with most websites will last for quite a while, even if you close the tab and/or
navigate away from the page, as long as you don't close your browser session.

cafevincent · Unread post by **cafevincent** » 2024-11-05, 10:42

kreemoweet wrote: ↑
2024-11-05, 06:55

cafevincent wrote: I have "allow sites to store cookies and data" set to disabled, and only the sites I want to log in to set to "allow for session" in exceptions, like "imdb.com". I have plenty of sites in the whitelist, but none are saving any cookies so I can't log in anywhere
Just allowing session cookies would not allow for preserving login information. By definition, session cookies are discarded when the browser is closed.
Automatic logins require persistent (non-session) cookies. Your logins with most websites will last for quite a while, even if you close the tab and/or
navigate away from the page, as long as you don't close your browser session.

I don't want want persistent logins, just to be able to log in for a session. My cookies are not saved at all according to my whitelist which should be well configured as far as I can tell.

BopBe · Unread post by **BopBe** » 2024-11-05, 16:20

I believe the protocol is needed as well for SSL webistes, e.g. https://imdb.com, otherwise if you only type the domain (imdb.com) in the cookie whitelist inputbox, it'll default to http (the non-secure variant) and it won't work.

Goodydino · Unread post by **Goodydino** » 2024-11-05, 22:06

kreemoweet wrote: ↑
2024-11-05, 06:55
Just allowing session cookies would not allow for preserving login information. By definition, session cookies are discarded when the browser is closed.
Automatic logins require persistent (non-session) cookies. Your logins with most websites will last for quite a while, even if you close the tab and/or
navigate away from the page, as long as you don't close your browser session.

Persistent cookies will last when the browser is shut down. It is just the session cookies that disappear when the browser closes.

cafevincent · Unread post by **cafevincent** » 2024-11-06, 13:53

BopBe wrote: ↑
2024-11-05, 16:20
I believe the protocol is needed as well for SSL webistes, e.g. https://imdb.com, otherwise if you only type the domain (imdb.com) in the cookie whitelist inputbox, it'll default to http (the non-secure variant) and it won't work.

Entering https://imdb.com did not resolve the issue. Cookies still missing.

suzyne · Unread post by **suzyne** » 2024-11-06, 22:48

The idea of a "whitelist" where everything not on the list is cleared I have not tried in Pale Moon before.

Is this a valid set of options?

When I have it set this way, when I sign into IMDB, and then exit from Pale Moon and go back to the site I am logged out.

Because it doesn't work the way I would expect it to, I must not be understanding what it means to have Always use private browsing mode and Allow sites to store cookies and site data on at the same time, and how that interacts with the Exceptions?

Unread post by **Moonchild** » 2024-11-07, 00:30

"Always use private browsing mode" will not store anything permanently. It uses in-memory storage only. That is the whole point of private browsing -- it's for local data security, i.e. after you close the browser there won't be anything left indicating what you browsed to. That includes cookies. While you allow the cookies to be set in your session with these settings, i.e. it will not block them, it will not write them to your profile.

cafevincent · Unread post by **cafevincent** » 2025-02-18, 16:03

Oh I see. There is no function to block cookies from being saved, only an option to autodelete when closing. This is my problem. There seems to be no browser or no extension on the planet to refuse the cookies using a whitelist (or better yet: temporarily allow a tab to set cookies, wherever forwarded) to allow online back functionality etc. At least no solution that works. How do people handle security properly then? This amazes me.

JayByrd · Unread post by **JayByrd** » 2025-02-18, 17:49

cafevincent wrote: ↑
2025-02-18, 16:03
Oh I see. There is no function to block cookies from being saved, only an option to autodelete when closing. This is my problem. There seems to be no browser or no extension on the planet to refuse the cookies using a whitelist (or better yet: temporarily allow a tab to set cookies, wherever forwarded) to allow online back functionality etc. At least no solution that works. How do people handle security properly then? This amazes me.

How about "Cookie Masters?" This extension does exactly what you claim to want... It even has the "temporarily allow" functionality you mention...

back2themoon · Unread post by **back2themoon** » 2025-02-18, 18:32

Better yet, Cookies Exterminator.

back2themoon · Unread post by **back2themoon** » 2025-02-25, 15:23

Is there a way (an extension, really) to selectively allow 3rd-party cookies? I gave Cookie Masters a try, but it didn't seem to detect and allow this.

The attempt was to allow disqus.com (= the 3rd-party) in this website. (efsyn.gr - example article with disqus comments section on bottom)

Gemmaugr · Unread post by **Gemmaugr** » 2025-02-25, 16:59

back2themoon wrote: ↑
2025-02-25, 15:23
Is there a way (an extension, really) to selectively allow 3rd-party cookies? I gave Cookie Masters a try, but it didn't seem to detect and allow this.

The attempt was to allow disqus.com (= the 3rd-party) in this website. (efsyn.gr - example article with disqus comments section on bottom)

I use eMatrix (https://addons.palemoon.org/addon/ematrix/) for that. I have Disqus globally blocked, but allowed on some sites as an exception.

back2themoon · Unread post by **back2themoon** » 2025-02-25, 17:16

That's a good suggestion, thanks.

I thought setting that website to Allow would be enough (either in Permissions Manager or Cookies exceptions - same thing essentially), but I guess I was wrong. Perhaps these exceptions/permissions are not meant for 3rd-party cookies.

edit: I always used "Accept 3rd-party from visited" (which doesn't require the above exception) but perhaps it's time to make things stricter. And maybe "from visited" is opening a can of worms? (Google etc.)

sunchild · Unread post by **sunchild** » 2025-03-07, 09:04

Private Browsing + Cookies would be the ideal setup for me. I'm pretty sure that a lot of people don't notice that the Keep Until part of it is greyed out. Maybe add a message saying that the cookies will be deleted when the browser is closed. Or even better, enable the Keep Until setting which is more intuitive and gives more control to the user.

Unread post by **Moonchild** » 2025-03-07, 13:00

sunchild wrote: ↑
2025-03-07, 09:04
Private Browsing + Cookies would be the ideal setup for me.

It's not possible. they are literally, by definition, in contradiction.
Private browsing mode is privacy for the local system. It does not make your web visits private to the outside world. Many people get this wrong. Private browsing will prevent anyone from finding out what you visited on your system by not storing anything locally. When you close a private browsing window, anything in that window's session will be thrown out because that is literally what using private browsing mode is.
Storing cookies outside of that window's session/on disk would obviously break local privacy as someone could see you have visited what you have in your private window by seeing the cookies left behind.

Pale Moon forum

Cookies exceptions whitelisting not working

Cookies exceptions whitelisting not working

Re: Cookies exceptions whitelisting not working

Re: Cookies exceptions whitelisting not working

Re: Cookies exceptions whitelisting not working

Re: Cookies exceptions whitelisting not working

Re: Cookies exceptions whitelisting not working

Re: Cookies exceptions whitelisting not working

Re: Cookies exceptions whitelisting not working

Re: Cookies exceptions whitelisting not working

Re: Cookies exceptions whitelisting not working

Re: Cookies exceptions whitelisting not working

Re: Cookies exceptions whitelisting not working

Re: Cookies exceptions whitelisting not working

Re: Cookies exceptions whitelisting not working

Re: Cookies exceptions whitelisting not working

Re: Cookies exceptions whitelisting not working

Re: Cookies exceptions whitelisting not working

Re: Cookies exceptions whitelisting not working

Re: Cookies exceptions whitelisting not working

Re: Cookies exceptions whitelisting not working