600372 - Discovery Pane logged in mode not working in prod

Status: RESOLVED FIXED

(addons.mozilla.org Graveyard :: Discovery Pane, defect, P3)

Description

[Justin Scott [:fligtar]]

While logged into AMO, the disco pane (https://services.addons.mozilla.org/en-US/firefox/discovery/3.7pre/Darwin) doesn't show me as logged in.

This worked on preview, so guessing there's a problem with services reading the cookie.

Comment 1

[Jeff Balogh (:jbalogh)]

addons.mozilla.org tells me this: Set-Cookie: AMOv3=xxx; path=/; secure; HttpOnly

Comment 2

[Wil Clouser [:clouserw]]

We're using standard domain cookies which means they are only accessible on AMO.  We could switch them to *.AMO but that means any other subdomain could see them, including FAMO, BAMO, PAMO, LAMO, and all the rest.  I don't trust any of those to see sessions.

We may need to XHR this data in after the page load.

Comment 3

[Justin Scott [:fligtar]]

Why don't you trust those to see sessions? It seems like accessing the AMO session from other subdomains will be desirable and possibly necessary in the future.

Comment 4

[Wil Clouser [:clouserw]]

FAMO is one of the most widely targeted and exploited forums on the market, BAMO has a questionable past regarding security, PAMO is not always tested code and can have exploits on it.  I don't see lifting the restriction.

Comment 5

[Wil Clouser [:clouserw]]

So, -> potch for front end stuff.  If you need someone to make you a back end chunk, let us know.

Comment 6

[Wil Clouser [:clouserw]]

I'm taking this.  Our cookie issues aren't resolved yet, but we're doing it the right way so it'll make this much better once we solve it.

Comment 7

[Wil Clouser [:clouserw]]

Well, the cookie is cross domain now, so this should just work.  We won't know until it's in production though and you'll probably need to log out/in.

Comment 8

[Stephen Donner [:stephend] Not actively reading bugmail]

Although I can't verify this _in prod_, I've verified that https://addons.allizom.org/en-US/firefox/discovery/3.6/Linux and the like pay attention to our logged-in/logged-out state, and reflect that correctly, on next/preview.

I'll verify post-push.

Comment 9

[Stephen Donner [:stephend] Not actively reading bugmail]

I spun off bug 613574 to cover SAMO.