Login credential persistance/cookies

I use a number of web sites, like Evernote, Protonmail, etc. that have an option to stay signed in for 30 days. This doesn’t seem to be working correctly for me. I’m using Firefox on Qubes, windows, Linux Mint. On all of them except Qubes, I can close Firefox, reboot the computer, etc. and the next time I go to the web page, I am already logged in.

On Qubes, if I close the browser (even without shutting down the qube), I have to log in all over again.

Note, I am NOT storing credentials in the firefox password manager. I confirmed that I do not have Firefox set to clear cookies on exit.

Did you configure something special in Firefox? Like arkenfox, extensions cleaning cookies etc…

Long explication about cookies and what they do when it comes to persistent login: The issue is mostly related to cookies not being persistent, the cookie is just a text file in your browser containing a session identifier that is presented when you go to the website, then the website lookup in its internal database if the session ID is someone already connected, if so, it will show you as already connected. Otherwise, you need to login to create that cookie and create the session in the website database.

This is not the default behavior.

Qubes’ Fedora and Debian templates by default provide firefox with standard default settings that will remember the above.

You can try to use other template: Debian, if you’re using Fedora and vice versa.
If it’s not an option, you can download new Fedora/Debian template and try with them.

I did something interesting. For a couple of sites I visit a lot, I took my normal “Arkenfoxed” Firefox which runs in a numbered disposable, and created a new disposable template. In that template I specifically whitelisted the cookies for that site and that site alone. So, if I run the template and log in, then immediately shut down, I should be able to start the disposable and be logged in.

It works well on some sites. THIS site, on the other hand, often logs me out. There’s no issue on other machines, but my “standing” QubesOS forum system kicks me out a LOT and I get to close the disposable (shutting it down), open the template, log in, shutdown the template, wait for it to finish shutting down, then start the disposable again.

There’s no rhyme or reason to it. Sometimes I can come back on one of my Qubes boxes after a week, and it works…sometimes I go back 20 minutes later only to find out I got logged off.

No, I am using the standard Firefox that came with the Debian template.

I have a few extensions in firefox, which I synch via my firefox account. They are:LastPass, Facebook Container, and Library Extension.

I’m familiar with how cookies act. I am not exactly sure where Firefox stores them, but I’d hope they would be under my home directory, which should be persisted with the qube.

Since I synch my settings from my Firefox account, it is possible that one of those settings has overridden a setting that Qubes needs. I just do not know what firefox setting that would be.

Do you know if those settings are documented somewhere? It is possible that when I set up synch from my firefox account, that they were overwritten.

It’s easier to just spin another template and compare them with what you got currently.
But you can miss something tiny.

Why not just try to spin a template → new qube → firefox → enter credentials → etc ?

Here’s what I have tried:

I just created a new qube called Test from the same debian template
I tested firefox in the new Test qube without signing into Firefox

I can confirm that login to Evernote was persistent in the above case.

Now I need to work out the difference. It could be extensions and/or settings. I’ll start by adding in extensions to see if that breaks the login persistence. I actually have 5 extensions in my synch profile, but 2 are disabled.

Adding all the same extensions didn’t cause any issue with persistence. Checking settings will be harder.

Found it. I had turned on clear history on exit in firefox. I had to modify the setting to NOT clear cookies at thee same time.

2 Likes