Implement 1p Ephemeral Storage Functionality (functionality)

[pes10k]

It would be useful to be able to have Brave visit a site where 1p-storage was ephemeral, in the same way 3p storage is currently by default.

The functionality described here is not intended to cover the settings and options Brave would expose to users (that might or might not change), only to describe the needed underlying capabilities. How 1p ephemeral storage capabilities could be exposed to users, or deployed to benefit users, is covered in other issues (e.g., #15097, #15018, etc)

This would include the following necessary functionality:

• "1p ephemeral storage sessions" are at site granularity
• DOM storage and cookies in a "1p ephemeral storage session" would be cleared as soon as there have been no top level documents open for the site, for more than seconds
• Other NetworkIsolationKey partitioned storage (HTTP cache, service workers, network cache, etc) would be similarly partitioned

Nice to have:

• "1p ephemeral storage sessions" are isolated from the site's normal storage area. This means that I should be able to have example.org open in a tab using a standard shields configuration, then open a new example.org tab in "1p ephemeral storage" mode, and that storage set in the "1p ephemeral storage" session would be independent of the standard example.org tab
• Similarly, you could have two different, independent "1p ephemeral storage sessions" at the same time, with the same site, both of which would be independent of standard 1p storage
• "1p ephemeral storage session" tabs taint each other, using sessionStorage logic. So if I open a example.org in a "1p ephemeral storage session", and then i open another top level document in the same site from that document, both tabs see the same "1p ephemeral storage area". (This might seem obvious, but I imagine it gets tricky when you could have 2 or more separate "1p ephemeral storage sessions" with the same site.)

[bridiver]

"Nice to have" is kind of a problem because I'm not sure what needs to be validated here or what happens to those things if we only implement part of this and do the rest later. Can we either create sub-tickets for this that exactly match the functionality in each PR or narrow down exactly what we are/have implemented?

[goodov]

This is currently a hidden feature behind a flag, but it can be tested:

1. Enable First Party Ephemeral Storage feature in brave://flags.
2. Add website to test into "Always clear cookies when windows are closed" list:
   
3. Test that a cookie value is persistent by opening multiple tabs of a website, for example https://yandex.com/internet. yandexuid value should stay the same.
4. Close all tabs and reopen https://yandex.com/internet, a new yandexuid value should appear.

Also a localStorage and sessionStorage can be tested using https://dev-pages.brave.software/storage/frames.html and other similar pages. The stored values should disappear when all tabs with a tested website are closed.

[stephendonner]

Verified PASSED using

Brave	1.32.74 Chromium: 95.0.4638.54 (Official Build) dev (x86_64)
Revision	d31a821ec901f68d0d34ccdbaea45b4c86ce543e-refs/branch-heads/4638@{#871}
OS	macOS Version 11.6 (Build 20G165)

Steps:

1. new profile
2. launched Brave
3. enabled First Party Ephemeral Storage feature via brave://flags
4. added [*.]yandex.com to Always clear cookies when windows are closed, in brave://settings/cookies
5. opened https://yandex.com/internet 5x (5 tabs)
6. noted the value of Content for the above
7. closed all tabs and windows (but not Brave)
8. opened https://yandex.com/internet in a single tab
9. noted the value of Content for the above

Confirmed Content is different for the 1) group of 5 tabs with the same URL 2) same URL in a single tab

example	example

[goodov]

@stephendonner thank you! That's the result I expect, but not the result I'd like to see :) I should've written more detailed explanation of what we're trying to test.

1. The Settings page and DevTools show cookies stored in a default persistent storage. If you visited a website without enabling the feature and adding a website into Always clear cookies when windows are closed list, the values will appear in these areas.
2. By enabling 1PES for a website (enable feature, add a website to the list), we effectively redirect all cookie save/load actions into ephemeral storage (ES) which is not viewable via Settings page or DevTools.

We want to test the 1PES logic:

1. The ability to keep cookies in ES while tabs with a tested website are opened
2. A cleanup after tabs with a tested website are closed (but not the cleanup after full browser/window close!)

So in the end we want to see ephemeral cookies, but we cannot see them in the browser UI. To solve this, we can add custom test pages or we can use a website which shows its cookie values right on the page. The https://yandex.com/internet is a just an example of a website that does that:

To test 1PES we need to make sure that the cookie value is same while at least one of the tabs is opened, and after closing/reopening tabs, the ephemeral cookie value should be deleted and a website should create a new cookie value.

[stephendonner]

Verified PASSED using

Brave	1.32.77 Chromium: 95.0.4638.54 (Official Build) dev (x86_64)
Revision	d31a821ec901f68d0d34ccdbaea45b4c86ce543e-refs/branch-heads/4638@{#871}
OS	macOS Version 11.6 (Build 20G165)

Steps:

1. new profile
2. launch Brave
3. enabled First Party Ephemeral Storage feature in brave://flags
4. added [*.]yandex.com to Always clear cookies when windows are closed, in brave://settings/cookies
5. loaded yandex.com/internet in 5 new tabs
6. noted the value for yandexuid was 83902131634853864, across all 5 tabs
7. closed all tabs (but NOT the browser)
8. loaded yandex.com/internet again in a single tab
9. noted the value for yandexuid was 3676166601634853957

example	example	example	example

---

Verified PASSED using

Brave	1.32.78 Chromium: 95.0.4638.54 (Official Build) beta (64-bit)
Revision	d31a821ec901f68d0d34ccdbaea45b4c86ce543e-refs/branch-heads/4638@{#871}
OS	Linux

Steps:

1. new profile
2. launch Brave
3. enabled First Party Ephemeral Storage feature in brave://flags
4. added [*.]yandex.com to Always clear cookies when windows are closed, in brave://settings/cookies
5. loaded yandex.com/internet in 5 new tabs
6. noted the value for yandexuid was 1992171635195119, across all 5 tabs
7. closed all tabs (but NOT the browser)
8. loaded yandex.com/internet again in a single tab
9. noted the value for yandexuid was 5004146051635195281

example	example	example	example

---

Verification passed on

Brave | 1.32.82 Chromium: 95.0.4638.54 (Official Build) dev (64-bit)
-- | --
Revision | d31a821ec901f68d0d34ccdbaea45b4c86ce543e-refs/branch-heads/4638@{#871}
OS | Windows 10 Version 21H1 (Build 19043.1288)

Logged a follow up issue #19006

Steps:

1. new profile
2. launch Brave
3. added [*.]yandex.com to Always clear cookies when windows are closed, in brave://settings/cookies
4. loaded yandex.com/internet in 5 new tabs
5. noted the value for yandexuid was 965761951635271465, across all 5 tabs
6. closed all tabs (but NOT the browser)
7. loaded yandex.com/internet again in a single tab
8. noted the value for yandexuid is still same 796542931635271605

example	example	example	example	example

[stephendonner]

@goodov sorry for the delay, and thanks for clarifying; how's the above look, now, verification-wise?

[goodov]

Yep, this is much better, thank you!

[stephendonner]

@goodov: I've tried to find the Android corollary, here, but so far am not finding it.

I'm not seeing a place where we can add the exception, noted in step 3, above, "added [*.]yandex.com to Always clear cookies when windows are closed, in brave://settings/cookies"

We have "Close tabs on exit," but that's for browser-session behavior, as is Clear data on exit.

[goodov]

@goodov: I've tried to find the Android corollary, here, but so far am not finding it.

I'm not seeing a place where we can add the exception, noted in step 3, above, "added [*.]yandex.com to Always clear cookies when windows are closed, in brave://settings/cookies"

We have "Close tabs on exit," but that's for browser-session behavior, as is Clear data on exit.

Huh, you're right. This option is not available on Android, but it's just a UI limitation, under the hood it should work. I guess we have to add this setting then.

[stephendonner]

@goodov: I've tried to find the Android corollary, here, but so far am not finding it.
I'm not seeing a place where we can add the exception, noted in step 3, above, "added [*.]yandex.com to Always clear cookies when windows are closed, in brave://settings/cookies"
We have "Close tabs on exit," but that's for browser-session behavior, as is Clear data on exit.

Huh, you're right. This option is not available on Android, but it's just a UI limitation, under the hood it should work. I guess we have to add this setting then.

1. Filed Implement adding site exceptions to Always clear cookies when tabs are closed #19476 to address this (which might/probably depends on another issue).
2. Removed OS/Android as this isn't yet implemented.