Ensure the "tweet this" or "like this" button does not generate a request to the 3rd party site simply by loading the Mozilla webpage the button is on (e.g. no requests to third party site without user's intent via clicking on the button).
Heise Online worked out a solution[0]: a two-click Like button. The first click replaces a placeholder with the official Facebook Like button. Facebook objected at first, but only because Heise tried to make their placeholder look official. A quick design change allowed them to keep it.
Yeah that's why I'm not sure. It could be attacked depending on the country I guess, and if you don't use a facebook-like icon, its hard to tell what you're going to like. Debatable I guess
A GET request for an embedded resource exposes the user's cookies for that domain and associates a user of one site as a user of another. This is fine when it is at the user's explicitly intended request, but when paired with certain sites known not to delete all cookies on logout, this is nefarious and should not be done.
Thank you for this.