1023792 - Error when registering with an already valid hawk session.

Status: VERIFIED FIXED

(Hello (Loop) :: Server, defect)

Description

[Alexis Metaireau (:alexis)]

It seems the server returns a 500 when following this flow:

1. Register with a valid FxA assertion;
2. Get back hawk session
3. Register again with an hawk session.

Comment 1

[Alexis Metaireau (:alexis)]

I've tried to reproduce here without success: https://github.com/mozilla-services/loop-server/compare/fix-registration

Comment 2

[Alexis Metaireau (:alexis)]

José, can you confirm the STR are valid here, and provide me with additional information so that I can try to reproduce and fix it?

Comment 3

[José Antonio Olivera Ortega [:jaoo]]

(In reply to Alexis Metaireau (:alexis) from comment #2)
> José, can you confirm the STR are valid here, and provide me with additional
> information so that I can try to reproduce and fix it?

Sure, the STR you commented at comment 0 is the one I followed. You can give a try with the app I prepared at https://github.com/jaoo/firefoxos-loop-client/tree/1023792-test-app. It seems to work from the FxOS 2.0 simulator. I'll attach a tcpdump log that might be helpful and the server crash.

Note, for the app you need to change the IP address of your server at https://github.com/jaoo/firefoxos-loop-client/blob/1023792-test-app/js/config.js#L6. Contact me if you hit any issue.

Comment 4

[José Antonio Olivera Ortega [:jaoo]]

Attachment: 1023792-tcpdump-log.txt

Comment 5

[José Antonio Olivera Ortega [:jaoo]]

Attachment: 1023792-server-crash.txt

Comment 6

[Alexis Metaireau (:alexis)]

Thanks for reporting this.

This is actually both a bug on the server and on the client. The client should provide a header like that:

> authorization: 'Hawk id="14fead980ee8e1f03f79f3f3ec293d3371f691d978d3ee2e223498f669bb38a5", ts="1402601140", nonce="5w-no8", hash="B0weSUXsMcb5UhL41FZbrUJCAotzSI3HawE1NPLRUz8=", mac="Vh1k2Ax4hM9CEwmhPUOPxvplJGLumAbmjGG7Rk0TxT4="'

The one you gave was malformed and so the server had troubles parsing it.
The one you are giving at the moment is like that:

> authorization: 'Hawk 714e6f024f1dad4bdde023c97a4e7033ec3940cd6d77727128c41c8eb095ee95'

Comment 7

[José Antonio Olivera Ortega [:jaoo]]

(In reply to Alexis Metaireau (:alexis) from comment #6)
> Thanks for reporting this.

Thanks for having a look into it.

> This is actually both a bug on the server and on the client. The client
> should provide a header like that:
> 
> > authorization: 'Hawk id="14fead980ee8e1f03f79f3f3ec293d3371f691d978d3ee2e223498f669bb38a5", ts="1402601140", nonce="5w-no8", hash="B0weSUXsMcb5UhL41FZbrUJCAotzSI3HawE1NPLRUz8=", mac="Vh1k2Ax4hM9CEwmhPUOPxvplJGLumAbmjGG7Rk0TxT4="'

Oh, sorry about sending a malformed authorization header. I have a question here, I've been sending request with that format for call urls and there wasn't any (that) issue. So is that format only valid for registration request? I'll fix the client side and land bug 1016423. Thanks Alexis!

Comment 8

[Alexis Metaireau (:alexis)]

For registration, I believe this is not valid either. If that was considered valid then we have a problem with the validation logic on the server side!

From what I've been looking at the code on your repo, and it seems that by default you're doing the right thing: https://github.com/jaoo/firefoxos-loop-client/blob/1023792-test-app/js/client_request_helper.js#L36

But here you're just falling in this case https://github.com/jaoo/firefoxos-loop-client/blob/1023792-test-app/js/client_request_helper.js#L30-L34 where it doesn't use the hawk lib !

Comment 9

[Alexis Metaireau (:alexis)]

Actually, just removing https://github.com/jaoo/firefoxos-loop-client/blob/1023792-test-app/js/client_request_helper.js#L30 does the trick on my machine :)

Comment 10

[Alexis Metaireau (:alexis)]

Attachment: link to github PR

Comment 11

[José Antonio Olivera Ortega [:jaoo]]

(In reply to Alexis Metaireau (:alexis) from comment #9)
> Actually, just removing
> https://github.com/jaoo/firefoxos-loop-client/blob/1023792-test-app/js/
> client_request_helper.js#L30 does the trick on my machine :)

Nope, the change needed it to use the hawk lib also for the registration request associated to the sign in user action.

Comment 12

[Rémy Hubscher (:natim)]

https://github.com/mozilla-services/loop-server/commit/0c84639dc0ef16251b50533a6a37324c2a3b6403

Comment 13

[James Bonacci [:jbonacci]]

Fix either went out with a previous deployment to Production or has been superceded by new code...