Chromium --disable-cookie-encryption not working

user_4080226 0
Viewed 991

I'm staring Chromium (version: 83) in Selenium. I'm starting it with `--disable-cookie-encryption.

options.AddArgument("disable-cookie-encryption");

On Chromium website, they refer to this list of valid arguments.

There is one argument:

--disable-cookie-encryption - Whether cookies stored as part of user profile are encrypted.

Once I open the chrome://version I can verify that the chrome was started with --disable-cookie-encryption argument.

The problem is that once I open the SQLite file where the cookies are stored (on the Default/Cookies file of the profile) they are still encrypted.

I have tried with Google Chrome and with Edge and none of them was working.

Any ideas on it? Is it really supported?

selenium-chromedriver selenium-webdriver selenium google-chrome chromium
1 Answers

The webpage List of Chromium Command Line Switches still mentions the --disable-cookie-encryption argument as follows:

--disable-cookie-encryption - Whether cookies stored as part of user profile are encrypted.

This setting is mentioned in headless_shell_switches.cc and possibly applicable only for headless mode.

// Copyright 2016 The Chromium Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

#include "headless/app/headless_shell_switches.h"

namespace headless {
namespace switches {

// The background color to be used if the page doesn't specify one. Provided as
// RGBA integer value in hex, e.g. 'ff0000ff' for red or '00000000' for
// transparent.
const char kDefaultBackgroundColor[] = "default-background-color";

// Whether cookies stored as part of user profile are encrypted.
const char kDisableCookieEncryption[] = "disable-cookie-encryption";

Deep Dive

As per the article Google Chrome to encrypt HTTP cookies on desktop systems google-chrome saves cookies to a file in the user's data folder. It is named Cookies and is a SQLite database. You can load it into any SQLeditor, for instance Firefox's SQLite Manager extension, to read all cookies that have been saved to the local system as a result of the user's Internet activities.

However, there is a change within Chromium as follows:

Encrypt all stored cookies on selected operating systems.

As part of the goal of protecting private user information, this encrypts the cookie values on operating systems with user-specific crypto APIs and that do not otherwise protect this data.

Performance tests indicate a penalty of about 1ms per cookie (regardless of size) on a Mac and 0.1ms to 0.7ms (depending on the size) under Windows. This will be higher on older hardware but still insignificant.

Encrypted data is binary (with an overhead of 128 bytes on Windows) and binary data must be stored in a BLOB so only one of two fields ("value" or "encrypted_value") will have data with the other being empty. Both values, however, need to be read & written when accessing a cookie because they are marked "non null").

This change enforces that all desktop versions of Google Chrome will encrypt stored cookies in the near future (while Chrome OS and Android use fully encrypted profiles already). This change only affects new cookies saved to the system after Chrome is updated with the new implementation. Existing cookies remain as is, while all new cookies will be encrypted by default by the browser.

Trade-off

It is to be noted that the performance drop that goes along with encrypting cookies is insignificant. On macos it is 1 ms while on windows os it may slow down up to 0.7 ms.

Conclusion

It appears after enforcing the recent change in the cookie policy disable-cookie-encryption is no more effective.

user_74294470
Related