feat: add experimental cookie encryption support #27524

MarshallOfSound · 2021-01-27T23:56:40Z

This is mostly exploratory but the intention is to provide an Electron Fuse to enable cookie encryption for Electron apps. This has several technical challenges (mostly coming down to hard coded assumptions in Chromium) and the intention is for this WIP PR to remain open while I figure out how to make it work on all three platforms in a generic and sustainable way.

Refs #7073

Platform support as of the moment you're reading this:

macOS
Windows 7
Windows 10
Linux (many variants, only ticked when all chromium secret stores are supported)

Migration paths from Un-Encrypted to Encrypted is completely handled by Chromium, it will continue to read un-encrypted cookies but will encrypt-on-write so over time even existing cookies will either expire or be written-over with an encrypted value.

Going the other way (encryp -> unencrypt) is not supported and will be a lossy action (all cookies will be considered invalid or be garbled in HTTP requests). This "revert" story should be documented before landing.

By default Chromium uses values like Chromium Safe Storage to store the encryption keys, Electron will use ${app.getName()} Safe Storage. This results in Electron Safe Storage being the default and packaged apps will have My App Safe Storage.

Notes: Added experimental cookie encryption support behind an Electron Fuse

nornagon · 2021-02-01T19:51:09Z

Cool stuff :)

patches/chromium/make_keychainpassword_service_name_and_service_name_mutable_strings.patch

nornagon · 2021-03-31T22:13:14Z

shell/browser/browser_process_impl.cc

+  // Only use a persistent prefs store when cookie encryption is enabled as that
+  // is the only key that needs it


what does the cookie encryption code use this for?

On windows the encryption secret is protected with DPAPI and the "protected" encryption key is stored in plain text in Local State on disk.

build/fuses/fuses.json5

shell/browser/net/system_network_context_manager.cc

nornagon · 2021-05-20T00:07:32Z

shell/browser/browser_process_impl.cc

+    scoped_refptr<JsonPrefStore> user_pref_store =
+        base::MakeRefCounted<JsonPrefStore>(prefs_path);
+    user_pref_store->ReadPrefs();
+    prefs_factory.set_user_prefs(user_pref_store);


Does this mean that when cookie encryption is enabled we might store other, non-cookie-encryption-related prefs on disk?

I guess so yeah, I would have made it JSON prefs for all cases but that felt like a bit of an overreach for this PR. It would align better with Chromium to do that though

What preferences are in that group? What would we start storing on disk that previously wasn't persisted?

My understanding is the only other pref we register into this store is the kProxy pref which is overridden / ignored by the per-browser-context proxy settings later down the line. That pref is never read / set in our code so being in memory vs stored to disk wouldn't appear to have any affected.

The reason we use an in-memory pref for the proxy config is because we reuse proxy config code from //chrome https://github.com/electron/electron/blob/master/patches/chromium/proxy_config_monitor.patch to interact with the proxy service and that relies on reading the configs from a pref store https://source.chromium.org/chromium/chromium/src/+/main:components/proxy_config/pref_proxy_config_tracker_impl.cc, I didn't find the need the flush these values to disk at that time as they are mainly required only to communicate the data between the browser process and the proxy service.

If the pref store is change to a persistent one when cookie encryption is enabled we should also make relevant changes here https://github.com/electron/electron/blob/master/shell/browser/api/electron_api_session.cc#L536

@deepak1556 The BrowserProcess prefs store and the BrowserContext prefs store are different and don't need to be aligned afaik. They store things in different locations and having one in memory and one not seems fine to me

You are right, they don't need to be in sync.

Proxy config in BrowserProcess pref store are read by the SystemNetworkContextManager whereas the BrowserContext pref store are read by per-session network contexts.

shell/browser/electron_browser_main_parts.cc

shell/browser/net/system_network_context_manager.cc

Co-authored-by: Jeremy Rose <jeremya@chromium.org>

jkleinsc

Is there anywhere we can document this feature? It doesn't seem that this feature is very discoverable as is.

samuelmaddock

API LGTM

shell/browser/browser_process_impl.cc

MarshallOfSound · 2021-05-25T18:55:05Z

It doesn't seem that this feature is very discoverable as is.

This is by design, Slack will take the load of testing it and once confidence is higher the plan is to document and flip then later fuse default 👍 Currently this is all very untested and critical to most applications so we're taking it very slowly.

release-clerk · 2021-05-26T19:16:58Z

Release Notes Persisted

Added experimental cookie encryption support behind an Electron Fuse

* feat: add experimental cookie encryption support on macOS * chore: fix TODO * update patches * feat: make cookie encryption work on windows * chore: update cookie encryption support comments * fix: only call OSCrypt::Init on windows * chore: make cookie encryption work on linux * Update shell/browser/net/system_network_context_manager.cc Co-authored-by: Jeremy Rose <jeremya@chromium.org> * chore: fix lint * chore: update patches * chore: update patches to upstreamed variants * chore: use chrome ::switches constants * chore: remove bad patch * build: disable cookie encryption by default * chore: update patches * fix: provide std::string to NoDestructor * chore: fix macos, nodestructor syntax * build: fix macOS build due to mismatch in DEFINE Co-authored-by: Electron Bot <electron@github.com> Co-authored-by: Jeremy Rose <jeremya@chromium.org>

trop · 2021-06-02T17:00:41Z

@MarshallOfSound has manually backported this PR to "14-x-y", please check out #29492

trop · 2021-06-02T17:00:45Z

@MarshallOfSound has manually backported this PR to "13-x-y", please check out #29493

* feat: add experimental cookie encryption support on macOS * chore: fix TODO * update patches * feat: make cookie encryption work on windows * chore: update cookie encryption support comments * fix: only call OSCrypt::Init on windows * chore: make cookie encryption work on linux * Update shell/browser/net/system_network_context_manager.cc Co-authored-by: Jeremy Rose <jeremya@chromium.org> * chore: fix lint * chore: update patches * chore: update patches to upstreamed variants * chore: use chrome ::switches constants * chore: remove bad patch * build: disable cookie encryption by default * chore: update patches * fix: provide std::string to NoDestructor * chore: fix macos, nodestructor syntax * build: fix macOS build due to mismatch in DEFINE Co-authored-by: Electron Bot <electron@github.com> Co-authored-by: Jeremy Rose <jeremya@chromium.org> Co-authored-by: Electron Bot <electron@github.com> Co-authored-by: Jeremy Rose <jeremya@chromium.org>

* feat: add experimental cookie encryption support (#27524) * feat: add experimental cookie encryption support on macOS * chore: fix TODO * update patches * feat: make cookie encryption work on windows * chore: update cookie encryption support comments * fix: only call OSCrypt::Init on windows * chore: make cookie encryption work on linux * Update shell/browser/net/system_network_context_manager.cc Co-authored-by: Jeremy Rose <jeremya@chromium.org> * chore: fix lint * chore: update patches * chore: update patches to upstreamed variants * chore: use chrome ::switches constants * chore: remove bad patch * build: disable cookie encryption by default * chore: update patches * fix: provide std::string to NoDestructor * chore: fix macos, nodestructor syntax * build: fix macOS build due to mismatch in DEFINE Co-authored-by: Electron Bot <electron@github.com> Co-authored-by: Jeremy Rose <jeremya@chromium.org> * chore: update patches Co-authored-by: Electron Bot <electron@github.com> Co-authored-by: Jeremy Rose <jeremya@chromium.org>

theogravity · 2023-05-03T21:21:55Z

It's unclear to me what the behavior is when you have support enabled and the user denies the prompt for keychain access in MacOS.

Do the cookies get stored unencrypted then? Is there a way for us to know that the user has denied this access?

MarshallOfSound requested a review from a team as a code owner January 27, 2021 23:56

electron-cation bot added the new-pr 🌱 PR opened in the last 24 hours label Jan 27, 2021

MarshallOfSound changed the title ~~feat: add experimental cookie encryption support on macOS~~ feat: add experimental cookie encryption support Jan 27, 2021

MarshallOfSound added the wip ⚒ label Jan 28, 2021

electron-cation bot removed the new-pr 🌱 PR opened in the last 24 hours label Feb 4, 2021

MarshallOfSound force-pushed the cookie-crypto branch from 3810333 to 0a48789 Compare February 25, 2021 22:06

MarshallOfSound added the semver/minor backwards-compatible functionality label Mar 1, 2021

electron-cation bot added the api-review/requested 🗳 label Mar 1, 2021

MarshallOfSound force-pushed the cookie-crypto branch from e601fc3 to 72f630b Compare March 22, 2021 23:32

MarshallOfSound removed the wip ⚒ label Mar 31, 2021

nornagon reviewed Mar 31, 2021

View reviewed changes

patches/chromium/make_keychainpassword_service_name_and_service_name_mutable_strings.patch Outdated Show resolved Hide resolved

nornagon reviewed Mar 31, 2021

View reviewed changes

MarshallOfSound force-pushed the cookie-crypto branch from d8c0db3 to d2ae996 Compare April 27, 2021 23:25

MarshallOfSound force-pushed the cookie-crypto branch from 5651f9f to d89a0f9 Compare May 19, 2021 23:32

nornagon reviewed May 20, 2021

View reviewed changes

shell/browser/electron_browser_main_parts.cc Show resolved Hide resolved

nornagon approved these changes May 21, 2021

View reviewed changes

deepak1556 reviewed May 21, 2021

View reviewed changes

shell/browser/net/system_network_context_manager.cc Outdated Show resolved Hide resolved

MarshallOfSound and others added 11 commits May 25, 2021 11:27

feat: add experimental cookie encryption support on macOS

11a1592

chore: fix TODO

52ecccf

update patches

6fcbcf8

feat: make cookie encryption work on windows

fade5e2

chore: update cookie encryption support comments

4956e7f

fix: only call OSCrypt::Init on windows

f66cebc

chore: make cookie encryption work on linux

f7acbbe

Update shell/browser/net/system_network_context_manager.cc

ea5782e

Co-authored-by: Jeremy Rose <jeremya@chromium.org>

chore: fix lint

4b7d9ce

chore: update patches

cb2532a

chore: update patches to upstreamed variants

13adfe2

chore: update patches

4300bd8

jkleinsc reviewed May 25, 2021

View reviewed changes

samuelmaddock approved these changes May 25, 2021

View reviewed changes

shell/browser/browser_process_impl.cc Show resolved Hide resolved

fix: provide std::string to NoDestructor

9bf0ffd

deepak1556 approved these changes May 25, 2021

View reviewed changes

MarshallOfSound added 2 commits May 25, 2021 19:04

chore: fix macos, nodestructor syntax

75fcf94

build: fix macOS build due to mismatch in DEFINE

c0ed578

MarshallOfSound merged commit 7984933 into master May 26, 2021

MarshallOfSound deleted the cookie-crypto branch May 26, 2021 19:16

This was referenced Jun 2, 2021

feat: add experimental cookie encryption support #29492

Merged

feat: add experimental cookie encryption support #29493

Merged

trop bot added the in-flight/14-x-y label Jun 2, 2021

trop bot added in-flight/13-x-y and removed in-flight/14-x-y labels Jun 2, 2021

electron-cation bot removed the api-review/requested 🗳 label Jun 2, 2021

trop bot added merged/13-x-y and removed in-flight/13-x-y labels Jun 3, 2021

MarshallOfSound mentioned this pull request Jun 29, 2021

persistent cookies should be encrypted #7073

Closed

georgexu99 mentioned this pull request Jul 5, 2021

feat: add electron.safeStorage encryption API #30020

Merged

5 tasks

kris7t mentioned this pull request Jan 10, 2022

[Feature Request]: Reset cookie encryption key #32407

Closed

3 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: add experimental cookie encryption support #27524

feat: add experimental cookie encryption support #27524

MarshallOfSound commented Jan 27, 2021 •

edited

nornagon commented Feb 1, 2021

nornagon Mar 31, 2021

MarshallOfSound Mar 31, 2021

nornagon May 20, 2021

MarshallOfSound May 20, 2021

nornagon May 21, 2021

MarshallOfSound May 21, 2021

deepak1556 May 21, 2021

deepak1556 May 21, 2021

MarshallOfSound May 25, 2021

deepak1556 May 25, 2021

jkleinsc left a comment

samuelmaddock left a comment

MarshallOfSound commented May 25, 2021

release-clerk bot commented May 26, 2021

trop bot commented Jun 2, 2021

trop bot commented Jun 2, 2021

theogravity commented May 3, 2023

		// Only use a persistent prefs store when cookie encryption is enabled as that
		// is the only key that needs it

feat: add experimental cookie encryption support #27524

feat: add experimental cookie encryption support #27524

Conversation

MarshallOfSound commented Jan 27, 2021 • edited

nornagon commented Feb 1, 2021

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jkleinsc left a comment

Choose a reason for hiding this comment

samuelmaddock left a comment

Choose a reason for hiding this comment

MarshallOfSound commented May 25, 2021

release-clerk bot commented May 26, 2021

trop bot commented Jun 2, 2021

trop bot commented Jun 2, 2021

theogravity commented May 3, 2023

MarshallOfSound commented Jan 27, 2021 •

edited