CRT/storebound
1
0
Fork 0
Code Issues Pull requests Releases 1 Packages 1 Activity Actions

console fill: never copy Google session cookies by default (device-bound); own profile in a Chrome started without automation switches

Browse source 
Google binds its session cookies to the device (Device Bound Session Credentials) and signs out
sessions whose cookies look stolen, which can sign the owner out of their real Chrome. The default is
now storebound's own profile per store; storebound starts Chrome itself (--user-data-dir,
--remote-debugging-port=0, no --enable-automation, navigator.webdriver false) and attaches over CDP.
--use-chrome-session google|apple is an explicit opt-in that warns. /signin/rejected is said plainly.
This commit is contained in:
CRTkafa 2026-10-12 07:46:04 +08:00
parent e0bef82b06
commit 0035931734
22 changed files with 456 additions and 156 deletions
Download patch file Download diff file Expand all files Collapse all files

15
CHANGELOG.md
View file

@ -2,6 +2,21 @@
## Unreleased
- Safety (`console fill`): storebound no longer copies the owner's Chrome cookies by default. A copied Google session
reached Play Console once, then Google answered `/v3/signin/rejected`: Google binds its session cookies to the
device (Chrome's Device Bound Session Credentials) and signs out sessions whose cookies look stolen, which can sign
the owner out of their real Chrome. Sources: blog.google/security/protecting-cookies-with-device-bound-session-credentials ,
knowledge.workspace.google.com/admin/security/investigate-and-take-action-on-suspicious-session-cookies .
- Default: storebound's own profile per store (`~/.storebound/console-profile/<store>`); the owner signs in once by
hand (the first run prints what to do) and it is kept.
- storebound starts that Chrome itself (`--user-data-dir`, `--remote-debugging-port=0`) and attaches over CDP: no
`--enable-automation`, `--disable-blink-features=AutomationControlled` (`navigator.webdriver` false), none of
Playwright's launch switches, Chrome's own user agent. Graceful close by CDP `Browser.close`.
- `--use-chrome-session google|apple`: explicit opt-in to the old copy, now of only that store's cookies; Google's
prints a warning about device-bound sessions. Apple's is opt-in too (Apple publishes no binding, but no guarantee).
- Google's `/signin/rejected` page is said plainly: "Google refused sign-in in this window".
- The desktop dialog no longer says it uses the Chrome sign-in. Pitfall 18.
- App Privacy purposes (wrong answers in `console fill apple-app-privacy`, `project.declarations` and `scan`): Play
"advertising" became both Third-Party Advertising and Developer's Advertising or Marketing (Device ID, Coarse
Location, Product Interaction, Performance Data). Now one Apple purpose per Play purpose, following Apple's