diff --git a/src/content/docs/reference/policies/BackgroundAppUpdate.mdx b/src/content/docs/reference/policies/BackgroundAppUpdate.mdx index ca9ec3e..6f8bf54 100644 --- a/src/content/docs/reference/policies/BackgroundAppUpdate.mdx +++ b/src/content/docs/reference/policies/BackgroundAppUpdate.mdx @@ -30,20 +30,9 @@ If you are having trouble getting the background task to run, verify your config Software\Policies\Mozilla\Firefox\BackgroundAppUpdate = 0x1 | 0x0 ``` -## macOS - -```xml - - BackgroundAppUpdate - | - -``` - ## Compatibility -Windows only. - **CCK2 Equivalent:** N/A\ **Preferences Affected:** `app.update.background.enabled` diff --git a/src/content/docs/reference/policies/ContentAnalysis.mdx b/src/content/docs/reference/policies/ContentAnalysis.mdx index 04580da..71b821f 100644 --- a/src/content/docs/reference/policies/ContentAnalysis.mdx +++ b/src/content/docs/reference/policies/ContentAnalysis.mdx @@ -33,7 +33,7 @@ Configure Firefox to use an agent for Data Loss Prevention (DLP) that is compati - `PlainTextOnly`: indicates whether to only analyze the text/plain format being copied. If this value is false, all formats being copied will be analyzed, which some DLP agents may not expect. Regardless of this value, files being copied will be analyzed as usual. The default is `true`. - - `Download`: controls download operations. (Added in Firefox 142, Firefox ESR 140.2) + - `Download`: controls download operations. - `Enabled`: indicates whether download operations should use DLP. The default is false. - `DragAndDrop`: controls drag and drop operations for files and text. - `Enabled`: indicates whether drag and drop operations should use DLP. The default is `true`. @@ -91,5 +91,3 @@ Software\Policies\Mozilla\Firefox\ContentAnalysis\TimeoutResult = 0x0 | 0x1 | 0x **CCK2 Equivalent:** N/A\ **Preferences Affected:** `browser.contentanalysis.agent_name`, `browser.contentanalysis.agent_timeout`, `browser.contentanalysis.allow_url_regex_list`, `browser.contentanalysis.bypass_for_same_tab_operations`, `browser.contentanalysis.client_signature`, `browser.contentanalysis.default_result`, `browser.contentanalysis.deny_url_regex_list`, `browser.contentanalysis.enabled`, `browser.contentanalysis.interception_point.clipboard.enabled`, `browser.contentanalysis.interception_point.clipboard.plain_text_only`, `browser.contentanalysis.interception_point.clipboard_copy.enabled`, `browser.contentanalysis.interception_point.clipboard_copy.plain_text_only`, `browser.contentanalysis.interception_point.download.enabled`, `browser.contentanalysis.interception_point.drag_and_drop.enabled`, `browser.contentanalysis.interception_point.drag_and_drop.plain_text_only`, `browser.contentanalysis.interception_point.file_upload.enabled`, `browser.contentanalysis.interception_point.print.enabled`, `browser.contentanalysis.is_per_user`, `browser.contentanalysis.max_connections`, `browser.contentanalysis.pipe_path_name`, `browser.contentanalysis.show_blocked_result`, `browser.contentanalysis.timeout_result` - -`ClipboardCopy` added in Firefox 158. diff --git a/src/content/docs/reference/policies/Cookies.mdx b/src/content/docs/reference/policies/Cookies.mdx index 374e0f4..d66fb27 100644 --- a/src/content/docs/reference/policies/Cookies.mdx +++ b/src/content/docs/reference/policies/Cookies.mdx @@ -6,12 +6,20 @@ category: "Network security" Configure cookie preferences. +This policy sets how Firefox handles cookies, and allows or blocks cookies for specific sites. +With `Locked`, users can't change these settings in Firefox. + +> [!NOTE] +> The `Allow`, `AllowSession` and `Block` values take a list of [origins](https://developer.mozilla.org/en-US/docs/Glossary/Origin). +> A domain such as `example.com` isn't a valid origin: you must include the `http://` or `https://` scheme. +> Additionally, you shouldn't include a path: `https://example.com/login` isn't a valid origin. + ## Values -- `Allow` is a list of origins (not domains) where cookies are always allowed. You must include `http` or `https`. - As of Firefox 154, using `Allow` to exempt sites from clearing on shutdown is deprecated. Firefox migrates origins to the new mechanism, but you should use [`SanitizeOnShutdown`](/reference/policies/sanitizeonshutdown/)'s `Exceptions` instead. -- `AllowSession` is a list of origins (not domains) where cookies are only allowed for the current session. You must include `http` or `https`. -- `Block` is a list of origins (not domains) where cookies are always blocked. You must include `http` or `https`. +- `Allow` is a list of [origins](https://developer.mozilla.org/en-US/docs/Glossary/Origin) where cookies are always allowed. + Using `Allow` to exempt sites from clearing on shutdown is deprecated. Firefox migrates origins to the new mechanism, but you should use [`SanitizeOnShutdown`](/reference/policies/sanitizeonshutdown/)'s `Exceptions` instead. +- `AllowSession` is a list of origins where cookies are only allowed for the current session. +- `Block` is a list of origins where cookies are always blocked. - `Behavior` sets the default behavior for cookies based on the following values: - `accept`: Accept all cookies. - `reject-foreign`: Reject third party cookies. @@ -75,7 +83,5 @@ Software\Policies\Mozilla\Firefox\Cookies\Locked = 0x1 | 0x0 -`reject-tracker-and-partition-foreign` renamed to `partition-foreign` in Firefox 153, using `Allow` to exempt sites from clearing on shutdown is deprecated in 154. - **CCK2 Equivalent:** N/A\ **Preferences Affected:** `network.cookie.cookieBehavior`, `network.cookie.cookieBehavior.pbmode`, `network.cookie.lifetimePolicy` diff --git a/src/content/docs/reference/policies/DisableTelemetry.mdx b/src/content/docs/reference/policies/DisableTelemetry.mdx index 8a001f8..776d891 100644 --- a/src/content/docs/reference/policies/DisableTelemetry.mdx +++ b/src/content/docs/reference/policies/DisableTelemetry.mdx @@ -37,7 +37,5 @@ Software\Policies\Mozilla\Firefox\DisableTelemetry = 0x1 | 0x0 -From Firefox 83 and Firefox ESR 78.5, local storage of telemetry data is also disabled. - **CCK2 Equivalent:** `disableTelemetry`\ **Preferences Affected:** `datareporting.healthreport.uploadEnabled`, `datareporting.policy.dataSubmissionEnabled`, `toolkit.telemetry.archive.enabled`, `datareporting.usage.uploadEnabled` diff --git a/src/content/docs/reference/policies/DisableThirdPartyModuleBlocking.mdx b/src/content/docs/reference/policies/DisableThirdPartyModuleBlocking.mdx index 71787a0..1ea46fd 100644 --- a/src/content/docs/reference/policies/DisableThirdPartyModuleBlocking.mdx +++ b/src/content/docs/reference/policies/DisableThirdPartyModuleBlocking.mdx @@ -31,7 +31,5 @@ Software\Policies\Mozilla\Firefox\DisableThirdPartyModuleBlocking = 0x1 | 0x0 -Windows only, GPO only. - **CCK2 Equivalent:** N/A\ **Preferences Affected:** N/A diff --git a/src/content/docs/reference/policies/DisabledCiphers.mdx b/src/content/docs/reference/policies/DisabledCiphers.mdx index c7da945..3dbd175 100644 --- a/src/content/docs/reference/policies/DisabledCiphers.mdx +++ b/src/content/docs/reference/policies/DisabledCiphers.mdx @@ -6,14 +6,10 @@ category: "Network security" Disable specific cryptographic ciphers. -> [!NOTE] -> This policy was updated in Firefox 78 to allow _enabling_ ciphers as well. -> Setting a value to `true` disables the cipher, setting a value to `false` enables the cipher. -> Previously, setting any value (`true` or `false`) disabled the cipher. - ## Values -The following cryptographic cyphers are configurable as `CIPHER_NAME`: +Set a cipher to `true` to disable it, or to `false` to enable it. +The following cryptographic ciphers are configurable as `CIPHER_NAME`: - `TLS_DHE_RSA_WITH_AES_128_CBC_SHA` - `TLS_DHE_RSA_WITH_AES_256_CBC_SHA` @@ -24,22 +20,55 @@ The following cryptographic cyphers are configurable as `CIPHER_NAME`: - `TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA` - `TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA` - `TLS_RSA_WITH_3DES_EDE_CBC_SHA` -- `TLS_RSA_WITH_AES_128_GCM_SHA256` (Firefox 78) -- `TLS_RSA_WITH_AES_256_GCM_SHA384` (Firefox 78) -- `TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256` (Firefox 97 and Firefox ESR 91.6) -- `TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256` (Firefox 97 and Firefox ESR 91.6) -- `TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384` (Firefox 97 and Firefox ESR 91.6) -- `TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384` (Firefox 97 and Firefox ESR 91.6) -- `TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA` (Firefox 97 and Firefox ESR 91.6) -- `TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA` (Firefox 97 and Firefox ESR 91.6) -- `TLS_CHACHA20_POLY1305_SHA256` (Firefox 138, Firefox ESR 128.10) -- `TLS_AES_128_GCM_SHA256` (Firefox 138, Firefox ESR 128.10) -- `TLS_AES_256_GCM_SHA384` (Firefox 138, Firefox ESR 128.10) +- `TLS_RSA_WITH_AES_128_GCM_SHA256` +- `TLS_RSA_WITH_AES_256_GCM_SHA384` +- `TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256` +- `TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256` +- `TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384` +- `TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384` +- `TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA` +- `TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA` +- `TLS_CHACHA20_POLY1305_SHA256` +- `TLS_AES_128_GCM_SHA256` +- `TLS_AES_256_GCM_SHA384` ## Examples +### Disabling a weak cipher + +This example disables the [3DES](https://en.wikipedia.org/wiki/Triple_DES) cipher, which is enabled by default: + +```json +{ + "policies": { + "DisabledCiphers": { + "TLS_RSA_WITH_3DES_EDE_CBC_SHA": true + } + } +} +``` + +### Disabling ciphers without forward secrecy + +This example disables the `TLS_RSA_WITH_*` ciphers, as they don't provide [forward secrecy](https://en.wikipedia.org/wiki/Forward_secrecy). +Verify that your servers support TLS 1.3 or a cipher that starts with `TLS_ECDHE_`, otherwise Firefox won't be able to connect to a server that only supports disabled ciphers. + +```json +{ + "policies": { + "DisabledCiphers": { + "TLS_RSA_WITH_3DES_EDE_CBC_SHA": true, + "TLS_RSA_WITH_AES_128_CBC_SHA": true, + "TLS_RSA_WITH_AES_256_CBC_SHA": true, + "TLS_RSA_WITH_AES_128_GCM_SHA256": true, + "TLS_RSA_WITH_AES_256_GCM_SHA384": true + } + } +} +``` + ## Windows (GPO) ``` diff --git a/src/content/docs/reference/policies/DisplayBookmarksToolbar.mdx b/src/content/docs/reference/policies/DisplayBookmarksToolbar.mdx index c9a63de..af7b192 100644 --- a/src/content/docs/reference/policies/DisplayBookmarksToolbar.mdx +++ b/src/content/docs/reference/policies/DisplayBookmarksToolbar.mdx @@ -35,7 +35,8 @@ Software\Policies\Mozilla\Firefox\DisplayBookmarksToolbar = "always", "never", " -The string values below were added in Firefox 108, Firefox ESR 102.7. Earlier versions accept only `true` or `false`. +The string values were added in Firefox 108, Firefox ESR 102.7. +Earlier versions accept only `true` or `false`. **CCK2 Equivalent:** N/A\ **Preferences Affected:** N/A diff --git a/src/content/docs/reference/policies/DisplayMenuBar.mdx b/src/content/docs/reference/policies/DisplayMenuBar.mdx index 941af72..b9ad3a4 100644 --- a/src/content/docs/reference/policies/DisplayMenuBar.mdx +++ b/src/content/docs/reference/policies/DisplayMenuBar.mdx @@ -23,22 +23,12 @@ Set the state of the menubar. Software\Policies\Mozilla\Firefox\DisplayMenuBar = "always", "never", "default-on", "default-off" ``` -## macOS - -```xml - - DisplayMenuBar - always | never | default-on | default-off - -``` - ## Compatibility -Windows and some Linux only. - -The string values below were added in Firefox 72, Firefox ESR 68.5. Earlier versions accept only `true` or `false`. +String values were added in Firefox 72, Firefox ESR 68.5. +Earlier versions accept only `true` or `false`. **CCK2 Equivalent:** `displayMenuBar`\ **Preferences Affected:** N/A diff --git a/src/content/docs/reference/policies/ExtensionSettings.mdx b/src/content/docs/reference/policies/ExtensionSettings.mdx index 8162762..554c1ff 100644 --- a/src/content/docs/reference/policies/ExtensionSettings.mdx +++ b/src/content/docs/reference/policies/ExtensionSettings.mdx @@ -269,7 +269,5 @@ Extensions whose own entry sets `installation_mode` to `allowed`, `force_install -As of Firefox 85, Firefox ESR 78.7, installing a theme makes it the default. - **CCK2 Equivalent:** N/A\ **Preferences Affected:** N/A diff --git a/src/content/docs/reference/policies/FirefoxSuggest.mdx b/src/content/docs/reference/policies/FirefoxSuggest.mdx index bb0f382..36af9f2 100644 --- a/src/content/docs/reference/policies/FirefoxSuggest.mdx +++ b/src/content/docs/reference/policies/FirefoxSuggest.mdx @@ -5,7 +5,6 @@ category: "Search" --- Customize Firefox Suggest (US only). -As of Firefox 146, `WebSuggestions` turns off Suggest completely. ## Values diff --git a/src/content/docs/reference/policies/LegacyProfiles.mdx b/src/content/docs/reference/policies/LegacyProfiles.mdx index 9a38259..a8f66e7 100644 --- a/src/content/docs/reference/policies/LegacyProfiles.mdx +++ b/src/content/docs/reference/policies/LegacyProfiles.mdx @@ -27,7 +27,5 @@ Software\Policies\Mozilla\Firefox\LegacyProfiles = 0x1 | 0x0 -Windows only, GPO only. - **CCK2 Equivalent:** N/A\ **Preferences Affected:** N/A diff --git a/src/content/docs/reference/policies/OverrideFirstRunPage.mdx b/src/content/docs/reference/policies/OverrideFirstRunPage.mdx index 6d1b582..208dd0f 100644 --- a/src/content/docs/reference/policies/OverrideFirstRunPage.mdx +++ b/src/content/docs/reference/policies/OverrideFirstRunPage.mdx @@ -9,8 +9,6 @@ Override the first run page. The first run page is what Firefox opens the first time a new profile is used, normally the onboarding tour at `about:welcome`. Setting this policy replaces that page and turns the onboarding tour off, so users go directly to the URL you specify. -Starting with Firefox 83, Firefox ESR 78.5, you can also specify multiple URLs separated by a vertical bar (`|`). - For the page shown after Firefox updates, see the [`OverridePostUpdatePage`](/reference/policies/overridepostupdatepage/) policy. ## Values diff --git a/src/content/docs/reference/policies/PasswordManagerEnabled.mdx b/src/content/docs/reference/policies/PasswordManagerEnabled.mdx index 5715284..175b75a 100644 --- a/src/content/docs/reference/policies/PasswordManagerEnabled.mdx +++ b/src/content/docs/reference/policies/PasswordManagerEnabled.mdx @@ -1,6 +1,6 @@ --- title: "PasswordManagerEnabled" -description: "Remove access to the password manager via preferences and blocks about:logins on Firefox 70." +description: "Remove access to the password manager via preferences and block about:logins." category: "Password manager" --- @@ -34,7 +34,5 @@ Software\Policies\Mozilla\Firefox\PasswordManagerEnabled = 0x1 | 0x0 -`about:logins` blocking added in Firefox 70, `browser.contextual-password-manager.enabled` also set from Firefox 154. - **CCK2 Equivalent:** N/A\ **Preferences Affected:** `pref.privacy.disable_button.view_passwords`, `signon.rememberSignons`, `browser.contextual-password-manager.enabled` diff --git a/src/content/docs/reference/policies/RequestedLocales.mdx b/src/content/docs/reference/policies/RequestedLocales.mdx index 601d17a..e1adeb5 100644 --- a/src/content/docs/reference/policies/RequestedLocales.mdx +++ b/src/content/docs/reference/policies/RequestedLocales.mdx @@ -55,7 +55,5 @@ or -As of Firefox 68, this can be a string so that you can specify an empty value (`""`). - **CCK2 Equivalent:** N/A\ **Preferences Affected:** N/A diff --git a/src/content/docs/reference/policies/SanitizeOnShutdown.mdx b/src/content/docs/reference/policies/SanitizeOnShutdown.mdx index b6e9974..ed989bb 100644 --- a/src/content/docs/reference/policies/SanitizeOnShutdown.mdx +++ b/src/content/docs/reference/policies/SanitizeOnShutdown.mdx @@ -102,8 +102,6 @@ Clear specific data types: -Object form added in Firefox 68/ESR 68. Starting with Firefox 136, `FormData` and `History` are separate data types. - **CCK2 Equivalent:** N/A\ **Preferences Affected:** `privacy.sanitize.sanitizeOnShutdown`, `privacy.clearOnShutdown.cache`, `privacy.clearOnShutdown.cookies`, `privacy.clearOnShutdown.downloads`, `privacy.clearOnShutdown.formdata`, `privacy.clearOnShutdown.history`, `privacy.clearOnShutdown.sessions`, `privacy.clearOnShutdown.siteSettings`, `privacy.clearOnShutdown.offlineApps`, `privacy.clearOnShutdown_v2.browsingHistoryAndDownloads`, `privacy.clearOnShutdown_v2.cookiesAndStorage`, `privacy.clearOnShutdown_v2.cache`, `privacy.clearOnShutdown_v2.siteSettings`, `privacy.clearOnShutdown_v2.formdata` diff --git a/src/content/docs/reference/policies/WindowsSSO.mdx b/src/content/docs/reference/policies/WindowsSSO.mdx index 81cd072..10b264c 100644 --- a/src/content/docs/reference/policies/WindowsSSO.mdx +++ b/src/content/docs/reference/policies/WindowsSSO.mdx @@ -27,8 +27,6 @@ Software\Policies\Mozilla\Firefox\WindowsSSO = 0x1 | 0x0 -Windows only. - **CCK2 Equivalent:** N/A\ **Preferences Affected:** `network.http.windows-sso.enabled`