Stochastic Nonsense

Put something smart here.

Safari Private Mode Is Broken

Safari private mode is reproducibly broken as of 2012 0524 on my completely updated macbook running OSX 10.7.4 and Safari 5.1.7 (7534.57.2). Software update lists no available updates.

My expectation, as set by the dialog box displayed when entering private browsing mode, was that no cookies created during the private browsing session would persist. The dialog box doesn’t specifically mention cookies, but the help accessed via clicking the question mark on the dialog box has this to say:

Any changes made to cookies are discarded when you turn off Private Browsing.

safari help

Therefore I thought that if I started safari, entered private mode, logged in to amazon, exited private mode, then restarted private mode and returned to amazon that I would be logged out because amazon would have no cookies to identify me. Instead, I’m still logged in to amazon and amazon remembers my session. This is true even if I quit safari after exiting private mode and before restarting it, verifying the process has exited via

1
2
$ ps aux | grep -i safari
earl           46104   0.0  0.0  2434892    572 s006  S+    2:23PM   0:00.00 grep -i safari

Reproduction steps:

  1. start safari
  2. clear all stored data (Preferences –> Privacy tab –> Remove All Website Data)
  3. start private mode
  4. navigate to amazon.com
  5. verify no amazon cookies exist (Develop –> Web Inspector –> delete amazon.com cookies, if any)
  6. login to amazon
  7. exit private mode
  8. quit safari and verify process ending via ps, as above
  9. start safari
  10. . start private mode
  11. . navigate to amazon.com
  12. . your amazon.com user is still logged in

Note that if you exit private mode then immediately reenter private mode without quitting safari, the amazon.com cookies created in private mode are deleted as safari claims. That is, if you replace step 7 above with:

  1. start private mode again
  2. navigate to amazon.com

Then your user will not be logged in and cookies will not have persisted.

Edit: as of 2012 0706, I found a workaround.