Session cookies are persisted on session restore

[goodov]

Chromium implements session cookie restore to persist them during updates (browser restart), but this is also applied when "Continue where you left off" is enabled. It's unclear if this is intentional, but this in fact allows these cookies to live much longer than other "persisted" cookie variants.

You can try this test https://bayden.com/test/sessions/
All Chromium browsers persists session cookies (but not sessionStorage) across page closes and browser resets in "Continue where you left off" mode.

An article from Eric Lawrence which also covers this topic:
https://textslashplain.com/2019/06/24/surprise-undead-session-cookies/

---

Note (by @ShivanKaul): this issue was fixed by brave/brave-core#17122 for all platforms except MacOS.

[goodov]

Note for @brave/qa-team - Need to run test cases 1, 2, 4 on Linux. Test case 3 is N/A. Should run 1, 2, 3, 4 on Windows and macOS.

Test case 1 (quit+open)

1. Ensure "Continue where you left off" is enabled.
2. Open https://bayden.com/test/sessions/ and choose lightcyan from selector.
3. Ensure sessionCookie says color is: lightcyan.
4. Fully quit browser.
5. Open browser.
6. Expect the session is restored and the website is still opened.
7. Refresh the page (Ctrl/Cmd+R).
8. Expect sessionCookie has changed to no value.

Test case 2 (brave://restart)

1. Ensure "Continue where you left off" is enabled.
2. Open https://bayden.com/test/sessions/ and choose lightcyan from selector.
3. Ensure sessionCookie says color is: lightcyan.
4. Restart the browser via brave://restart.
5. Expect the session is restored and the website is still opened.
6. Refresh the page (Ctrl/Cmd+R).
7. Expect sessionCookie is still lightcyan.

Test case 3 (browser update)

1. Install slightly old nightly version which includes this fix, but which will want to update.
2. Ensure "Continue where you left off" is enabled.
3. Open https://bayden.com/test/sessions/ and choose lightcyan from selector.
4. Ensure sessionCookie says color is: lightcyan.
5. Apply update via "Update" button, browser should restart automatically.
6. Expect the session is restored and the website is still opened.
7. Refresh the page (Ctrl/Cmd+R).
8. Expect sessionCookie is still lightcyan.

Test case 4 (disabled feature, old behavior)

1. Ensure "Continue where you left off" is enabled.
2. Open https://bayden.com/test/sessions/ and choose lightcyan from selector.
3. Ensure sessionCookie says color is: lightcyan.
4. Fully quit browser.
5. Launch browser with --disable-features=BraveCleanupSessionCookiesOnSessionRestore.
6. Expect the session is restored and the website is still opened.
7. Refresh the page (Ctrl/Cmd+R).
8. Expect sessionCookie is still lightcyan.

[LaurenWags]

Verified with

Brave | 1.50.92 Chromium: 111.0.5563.64 (Official Build) beta (x86_64)
-- | --
Revision | c710e93d5b63b7095afe8c2c17df34408078439d-refs/branch-heads/5563@{#995}
OS | macOS Version 12.6.3 (Build 21G419)

Verified test plan from #28379 (comment).

Test Case 1 (quit + open) - PASSED

1. Ensure "Continue where you left off" is enabled.
2. Open https://bayden.com/test/sessions/ and choose lightcyan from selector.
3. Ensure sessionCookie says color is: lightcyan.
4. Fully quit browser.
5. Open browser.
6. Expect the session is restored and the website is still opened.
7. Refresh the page (Ctrl/Cmd+R).
8. Expect sessionCookie has changed to undefined.

Note, confirmed with @goodov that sessionCookie has no value is ok here, the main thing is that this sessionCookie does not say lightcyan.

Step 1	Step 3	Step 6	Step 8

Test case 2 (brave://restart) - PASSED

1. Ensure "Continue where you left off" is enabled.
2. Open https://bayden.com/test/sessions/ and choose lightcyan from selector.
3. Ensure sessionCookie says color is: lightcyan.
4. Restart the browser via brave://restart.
5. Expect the session is restored and the website is still opened.
6. Refresh the page (Ctrl/Cmd+R).
7. Expect sessionCookie is still lightcyan.

Step 1	Step 3	Step 5	Step 7

Test case 3 (browser update) - FAILED, follow up issue logged

1. Install slightly old beta version which includes this fix, but which will want to update. (I used 1.50.86)
2. Ensure "Continue where you left off" is enabled.
3. Open https://bayden.com/test/sessions/ and choose lightcyan from selector.
4. Ensure sessionCookie says color is: lightcyan.
5. Navigate to brave://settings/help and apply update via "Relaunch" button, browser should restart automatically.
6. Expect the session is restored and the website is still opened.
7. Navigate to test page and refresh the page (Ctrl/Cmd+R).
8. Expect sessionCookie is still lightcyan. However, it is not. Logged session cookie not persisted on restart when applying browser update - follow up to 28379 #29135 as a follow up.

Step 1	Step 2	Step 4	Step 5	Step 8

Test case 4 (disabled feature, old behavior) - PASSED

1. Ensure "Continue where you left off" is enabled.
2. Open https://bayden.com/test/sessions/ and choose lightcyan from selector.
3. Ensure sessionCookie says color is: lightcyan.
4. Fully quit browser.
5. Launch browser with --disable-features=BraveCleanupSessionCookiesOnSessionRestore.
6. Expect the session is restored and the website is still opened.
7. Refresh the page (Ctrl/Cmd+R).
8. Expect sessionCookie is still lightcyan.

Logs from step 5:

laurenwags@Laurens-MBP ~ % /Applications/Brave\ Browser\ Beta.app/Contents/MacOS/Brave\ Browser\ Beta --args --enable-logging=stderr --disable-features=BraveCleanupSessionCookiesOnSessionRestore
[17908:259:0317/133341.048336:WARNING:chrome_main_delegate.cc(618)] This is Chrome version 111.1.50.92 (not a warning)
[17908:259:0317/133341.313808:WARNING:external_provider_impl.cc(503)] Malformed extension dictionary for extension: odbfpeeihdkbihmopkbjmoonfanlbfcl.  Key external_update_url has value "", which is not a valid URL.
objc[17917]: Class WebSwapCGLLayer is implemented in both /System/Library/Frameworks/WebKit.framework/Versions/A/Frameworks/WebCore.framework/Versions/A/Frameworks/libANGLE-shared.dylib (0x7ffb5c20fec8) and /Applications/Brave Browser Beta.app/Contents/Frameworks/Brave Browser Beta Framework.framework/Versions/111.1.50.92/Libraries/libGLESv2.dylib (0x1074aa850). One of the two will be used. Which one is undefined.
[17908:259:0317/133342.387026:INFO:CONSOLE(12)] "{"sessionColor":"lightcyan"}", source: https://bayden.com/test/sessions/ (12)

Step 1	Step 3	Step 8

Regression set 1 - "Open the New Tab page" setting - PASSED

Case 1:

1. Ensure "Open the New Tab page" is enabled.
2. Open https://bayden.com/test/sessions/ and choose lightcyan from selector.
3. Ensure sessionCookie says color is: lightcyan.
4. Fully quit browser.
5. Open browser.
6. Expect the session is not restored and the website is not still opened.
7. Navigate to https://bayden.com/test/sessions/
8. Refresh the page (Ctrl/Cmd+R).
9. Expect sessionCookie has no value.
10. Confirmed this behaves the same in 1.49.x as well

Step 1	Step 3	Step 9

Case 2:

1. Ensure "Open the New Tab page" is enabled.
2. Open https://bayden.com/test/sessions/ and choose lightcyan from selector.
3. Ensure sessionCookie says color is: lightcyan.
4. Restart the browser via brave://restart.
5. Expect the session is restored and the website is still opened.
6. Refresh the page (Ctrl/Cmd+R).
7. Expect sessionCookie is still lightcyan.
8. Confirmed this behaves the same in 1.49.x as well

Step 1	Step 3	Step 7

Case 3:

1. Install slightly old version which will want to update. (I used 1.50.86)
2. Ensure "Open the New Tab page" is enabled.
3. Open https://bayden.com/test/sessions/ and choose lightcyan from selector.
4. Ensure sessionCookie says color is: lightcyan.
5. Navigate to brave://settings/help and apply update via "Relaunch" button, browser should restart automatically.
6. Expect the session is not restored and the website is not still opened.
7. Navigate to https://bayden.com/test/sessions/
8. Refresh the page (Ctrl/Cmd+R).
9. Expect sessionCookie has no value.
10. Confirmed this behaves the same in 1.49.x as well

Step 2	Step 4	Step 9

Regression set 2 - "Open a specific page or set of pages" setting - PASSED

Case 1:

1. Ensure "Open a specific page or set of pages" is enabled (have at least one page configured like brave.com)
2. Open https://bayden.com/test/sessions/ and choose lightcyan from selector.
3. Ensure sessionCookie says color is: lightcyan.
4. Fully quit browser.
5. Open browser.
6. Expect the session is not restored and the website is not still opened.
7. Navigate to https://bayden.com/test/sessions/
8. Refresh the page (Ctrl/Cmd+R).
9. Expect sessionCookie has no value.
10. Confirmed this behaves the same in 1.49.x as well

Step 1	Step 3	Step 9

Case 2:

1. Ensure "Open a specific page or set of pages" is enabled (have at least one page configured like brave.com)
2. Open https://bayden.com/test/sessions/ and choose lightcyan from selector.
3. Ensure sessionCookie says color is: lightcyan.
4. Restart the browser via brave://restart.
5. Expect the session is restored and the website is still opened.
6. Refresh the page (Ctrl/Cmd+R).
7. Expect sessionCookie is still lightcyan.
8. Confirmed this behaves the same in 1.49.x as well

Step 1	Step 3	Step 7

Case 3:

1. Install slightly old version which will want to update. (I used 1.50.86)
2. Ensure "Open a specific page or set of pages" is enabled (have at least one page configured like brave.com)
3. Open https://bayden.com/test/sessions/ and choose lightcyan from selector.
4. Ensure sessionCookie says color is: lightcyan.
5. Navigate to brave://settings/help and apply update via "Relaunch" button, browser should restart automatically.
6. Expect the session is not restored and the website is not still opened.
7. Navigate to https://bayden.com/test/sessions/
8. Refresh the page (Ctrl/Cmd+R).
9. Expect sessionCookie has no value.
10. Confirmed this behaves the same in 1.49.x as well

Step 2	Step 4	Step 9

[goodov]

Test case 3 (browser update) - FAILED, follow up issue logged

I dig a little and found a PR which tries to fix the restart on MacOS. Right now it doesn't work as expected, instead it's pretty crazy how the "update restart" currently actually works on MacOS (in a bad way).

https://github.com/brave/brave-core/pull/15257/files#r1140262599