https://browseraudit.com picks up one critical error with Brave (in my case running on Mac OS)
This post has nothing to do with Brave Rewards. I recommend you move it to the Desktop Support category.
opened 11:02AM - 14 Feb 21 UTC
closed 08:04AM - 18 Feb 21 UTC
privacy
closed/not-actionable
OS/Android
OS/Desktop
<!-- Have you searched for similar issues? Before submitting this issue, please … check the open issues and add a note before logging a new issue.
PLEASE USE THE TEMPLATE BELOW TO PROVIDE INFORMATION ABOUT THE ISSUE.
INSUFFICIENT INFO WILL GET THE ISSUE CLOSED. IT WILL ONLY BE REOPENED AFTER SUFFICIENT INFO IS PROVIDED-->
## Description
When visiting `https://browseraudit.com/` We get one critical issue related to Cookies over http
## Steps to Reproduce
1. Open `https://browseraudit.com/`
2. Let it complete it run
3. End of the benchmark run, it will show scores, with one "Critical". (See Screenshot below)
## Actual result:
## Expected result:
Block `Cookie set by JavaScript should not be sent over HTTP`
## Reproduces how often:
Easily reproduced
## Brave version (brave://version info)
`Version 1.20.103 Chromium: 88.0.4324.152 (Official Build) (64-bit)`
## Version/Channel Information:
- Can you reproduce this issue with the current release? Yes
- Can you reproduce this issue with the beta channel? Yes
- Can you reproduce this issue with the nightly channel? Yes
## Other Additional Information:
- Does the issue resolve itself when disabling Brave Shields? No
- Does the issue resolve itself when disabling Brave Rewards?
- Is the issue reproducible on the latest version of Chrome?
## Miscellaneous Information:
Issue was discussed on Twitter, I've created this report to detail the issue
**Firefox passes test (Denys js setting cookies via http)**
**Chrome:**
cc: @pes10k
According to @pes , Director of Privacy:
So turns out this is a test bug. Chromium automatically upgrades the request to HTTPS, which causes the cookie to be sent (bc its now HTTPS) which confuses the test (which doesn’t expect the upgrade and so doesn’t expect the cookie). Firefox seems to not upgrade the request, which is what causes the test to be green for them.