1033355 - Credentials from voyages-sncf.mobi lost after device reboot (B2G) or Browser restarted (Firefox for Android)

Status: RESOLVED WONTFIX

(Web Compatibility :: Site Reports, defect, P5)

Description

[:gerard-majax]

STR:
 0. Connect on voyages-sncf.mobi installed as a bookmark
 1. Reboot device

Expected:
 When I reopen the bookmark, my session is kept

Actual:
 I have to relogin

Comment 1

[:gerard-majax]

Can also be triggered by a stop b2g && start b2g.

Comment 2

[:gerard-majax]

This is also affecting the OVH hubic application.

Comment 4

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

After talking to Alexandre, reopening for investigation.

Comment 5

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

I am amused by the website that you have to select other languages for english.

I used facebook, bugzilla, gmail, yahoo mail, and cnn and they were still signed in there just fine.


If this is still occurring, I think it's the web pages.  I'm not exactly sure how to sign into voyages-sncf.mobi and I'm not sure what OVH hubic is.

Comment 6

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

If this is still occurring, please change to tech evang if you concur.

Comment 7

[:gerard-majax]

(In reply to Naoki Hirata :nhirata (please use needinfo instead of cc) from comment #5)
> I am amused by the website that you have to select other languages for
> english.
> 
> I used facebook, bugzilla, gmail, yahoo mail, and cnn and they were still
> signed in there just fine.
> 
> 
> If this is still occurring, I think it's the web pages.  I'm not exactly
> sure how to sign into voyages-sncf.mobi and I'm not sure what OVH hubic is.

Voyages SNCF is the website I use to buy my train tickets for commuting :). OVH Hubic is a storage service, similar to Google Drive/Dropbox.

I'll recheck.

Comment 8

[:gerard-majax]

Naoki, I'm not convinced it's only due to the website itself.

STR:
 0. Navigate to https://voyages-sncf.mobi, with the useragent override:
> user_pref("general.useragent.override.voyages-sncf.mobi", "Mozilla/5.0 (Android; Mobile; rv:38.0) Gecko/38.0 Firefox/38.0");
 1. Refuse the Android app :)
 2. You should be presented a banner about Cookies, accept
 3. Login, and check the "remember me" checkbox
 4. Reboot the device, navigate again

Expected:
 I am still logged in

Actual:
 I'm logged out, and I get the cookie banner again.

Comment 9

[:gerard-majax]

Yet, after checking on Android with Firefox Nightly, I do reproduce the exact same behavior: killing the browser makes me logged out :(

Comment 10

[:gerard-majax]

And that's the same on Firefox for Android stable :(

Comment 11

[:gerard-majax]

Same with Firefox Nightly on my desktop, with or without the user agent override.

Comment 13

[:gerard-majax]

Karl, can you help me ?

Comment 14

[Karl Dubost💡 :karlcow]

Alexandre,

Did you use a clean profile?

Do you observe differences in cookies in between Firefox and another browser?
see http://www.otsukare.info/2014/11/12/configure-webcompat-browser
If there's a difference in cookies, is it visible which one?
Is the same happening on other browsers?

Comment 15

[:gerard-majax]

(In reply to Karl Dubost :karlcow from comment #14)
> Alexandre,
> 
> Did you use a clean profile?

Yes.

> 
> Do you observe differences in cookies in between Firefox and another browser?
> see http://www.otsukare.info/2014/11/12/configure-webcompat-browser
> If there's a difference in cookies, is it visible which one?

I'm going to check, but the "remember_me" cookie is properly set.

> Is the same happening on other browsers?

Comment 16

[:gerard-majax]

Tested in Chromium and I have the same behavior. BTW in the meantime I've contacted the website support and explained them my issue, I hope they will get back to me soon.

Comment 17

[:gerard-majax]

I got a reply from support, they are transferring this to technical people.

Comment 18

[:gerard-majax]

Investigating HubiC issues, I found both expose the same behavior: session ID cookie is send with an epoch expire:

> name: JSESSIONID                                         
> value: xxxx.bk-vsc-tgv-3     
> host: voyages-sncf.mobi                                  
> path: /                                                  
> expires: Wed Dec 31 23:59:59 1969 GMT (at end of session)
> created: Wed Apr 08 12:15:58 2015 GMT                    
> is secure: false                                         
> is httpOnly: false   

So, B2G restarting probably triggers the "end of session".

Comment 19

[Karl Dubost💡 :karlcow]

(In reply to Alexandre LISSY :gerard-majax from comment #17)
> I got a reply from support, they are transferring this to technical people.

Wonderful! Thanks.

Comment 20

[:gerard-majax]

Karl, I got a new reply from the support, in french:

> Nous regrettons ce délai exceptionnel de traitement de votre demande.
> 
> Soucieux de répondre au mieux à vos attentes, vos remarques ont été remontées à nos équipes techniques.
> 
> Cette anomalie a été identifiée et sera corrigée très prochainement.
> 
> Vous présentant nos excuses pour la gêne occasionnée.
> 
> Cordialement. 

So for non french readers, it means they have identified the issue and it will be fixed soon. Thanks to anyone from this team that may be reading this bug :)

Comment 21

[Karl Dubost💡 :karlcow]

Very cool Alexandre.

Comment 22

[:gerard-majax]

Four months after. Still not working on B2G.

Comment 23

[:gerard-majax]

Still nothing.

Comment 24

[:gerard-majax]

Jean, I think we should seriously work on session restoring on B2G: this is the kind of issues that crippled a foxfood experience.

Comment 25

[:gerard-majax]

(In reply to Alexandre LISSY :gerard-majax from comment #24)
> Jean, I think we should seriously work on session restoring on B2G: this is
> the kind of issues that crippled a foxfood experience.

On Firefox Nightly for Android, this is mitigated because we have the password manager kicking in.

Comment 26

[:gerard-majax]

I guess password manager would be easier?

Comment 27

[:gerard-majax]

Looks like we loose the session after a few hours:

 - login
 - display tickets list
 - wait a few hours (one? two? At least )
 - go back on home page of website

Expected: still logged in
Actual: disconnected