1163725 - tracking protection: 49ers.com video does not load

Status: RESOLVED WORKSFORME

(Web Compatibility :: Site Reports, defect, P3)

Description

[Matt Wobensmith [:mwobensmith][:matt:]]

http://www.49ers.com/video/videos/The-Faithful-The-Grateful-Faithful/e9b5115c-c399-4399-b387-1fa212166bfe

Video not shown, because of blocked resource "www.googletagservices.com/tag/js/gpt.js"

Comment 1

[Rebecca Billings [:rbillings]]

Tested on 58.0a1 with TP enabled. Video image shows on page, but will not play. Many other resources are also blocked.

Comment 2

[Oana Arbuzov [:oanaarbuzov]]

The URL http://www.49ers.com/video/videos/The-Faithful-The-Grateful-Faithful/e9b5115c-c399-4399-b387-1fa212166bfe seems to be updated. I found a video that was not playing on the URL: https://www.49ers.com/video/who-will-be-jimmy-garoppolo-s-biggest-weapon-in-2018

This is related to "tracking protection" breakage and it is reproducible with TP Strict only.

Looking at the devtools console, here are the blocked resources:
The resource at “https://www.googletagservices.com/tag/js/gpt.js” was blocked because tracking protection is enabled.
The resource at “https://nflenterprises.tt.omtrdc.net/m2/nflenterprises/mbox/json?mbox=target-global-mbox&mboxSession=c59157edd9e742cfbbc997305279b552&mboxPC=c59157edd9e742cfbbc997305279b552.26_12&mboxPage=d44b31caac90479792e6c68ae862c5d4&mboxRid=3869bd6b44c4477f8b35fc25df2d8736&mboxVersion=1.3.0&mboxCount=1&mboxTime=1532094439113&mboxHost=www.49ers.com&mboxURL=https%3A%2F%2Fwww.49ers.com%2Fvideo%2Fwho-will-be-jimmy-garoppolo-s-biggest-weapon-in-2018&mboxReferrer=&mboxXDomain=enabled&browserHeight=930&browserWidth=1920&browserTimeOffset=180&screenHeight=1080&screenWidth=1920&colorDepth=24&mboxMCSDID=7C7E6335917B229D-3433FE30B4F638DB&mboxMCGVID=60717769432473100590880444630161139057&mboxAAMB=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&mboxMCGLH=6” was blocked because tracking protection is enabled.
The resource at “https://cdn.taboola.com/libtrc/nfl-network-49ers/loader.js” was blocked because tracking protection is enabled.
The resource at “https://play.google.com/intl/en_us/badges/images/generic/en_badge_web_generic.png” was blocked because tracking protection is enabled.
The resource at “https://nfl.demdex.net/event?_ts=1532083639447” was blocked because tracking protection is enabled.
The resource at “https://munchkin.marketo.net/munchkin.js” was blocked because tracking protection is enabled.
The resource at “https://connect.facebook.net/en_US/fbevents.js” was blocked because tracking protection is enabled.
The resource at “https://static.chartbeat.com/js/chartbeat.js” was blocked because tracking protection is enabled.
The resource at “https://sb.scorecardresearch.com/r?c2=3005386&d.c=gif&d.o=nflclubs49ers&d.x=41494355&d.t=page&d.u=https%3A%2F%2Fwww.49ers.com%2Fvideo%2Fwho-will-be-jimmy-garoppolo-s-biggest-weapon-in-2018” was blocked because tracking protection is enabled.
The resource at “https://www.facebook.com/tr?id=145147715903534&ev=pageview&noscript=1&cd[api_key]=2c94c016-a8e0-4265-8d96-5dd5b7a9af9a&cd[action]=pageview&cd[placement]=49ers.com&cd[id]=%2Fvideo%2Fwho-will-be-jimmy-garoppolo-s-biggest-weapon-in-2018&cd[type]=webpage&cd[label]=Who%20Will%20Be%20Jimmy%20Garoppolo%27s%20Biggest%20Weapon%20in%202018%3F” was blocked because tracking protection is enabled.
The resource at “https://cdns.gigya.com/js/gigya.js?apiKey=3_JuHa5qkVIfY_KsNk1TuudSQT5Nif4axD-QXug1OgBmAgVieKA56umYvWPnoursaC” was blocked because tracking protection is enabled.
The resource at “https://adservice.google.ro/adsid/integrator.js?domain=www.nfl.com” was blocked because tracking protection is enabled.
The resource at “https://dpm.demdex.net/id?d_visid_ver=2.4.0&d_fieldgroup=AAM&d_rtbd=json&d_ver=2&d_orgid=F75C3025512D2C1D0A490D44%40AdobeOrg&d_nsid=0&d_mid=84622709431776132236619427398525748897&d_cid_ic=AVID%012DA8DE4E053118E0-60000110C00000F2&ts=1532083640178” was blocked because tracking protection is enabled.
The resource at “https://srv-2018-07-20-10.config.parsely.com/config/nfl.com” was blocked because tracking protection is enabled.
The resource at “https://secure.adnxs.com/getuid?https%3A%2F%2Fsync.vmweb.net%2Fsync%2Fappnexus%3Fpartner%3Dappnexus%26partner_id%3D%24UID%26vuid%3D48fc4df75a9243e907b20e5993ed565f9daf49b3df207502918e13ada636bd70” was blocked because tracking protection is enabled.
The resource at “https://tags.bluekai.com/site/46479?ID=48fc4df75a9243e907b20e5993ed565f9daf49b3df207502918e13ada636bd70” was blocked because tracking protection is enabled.
The resource at “https://idsync.rlcdn.com/401176.gif?partner_uid=4f52d7087df4df3ea0eee4d689125e9b9da6fa6c” was blocked because tracking protection is enabled.
The resource at “https://pixel.mathtag.com/sync/img?redir=https%3A%2F%2Fsync.vmweb.net%2Fsync%2Fmediamath%3Fvuid%3D48fc4df75a9243e907b20e5993ed565f9daf49b3df207502918e13ada636bd70%26partner_id%3D%5BMM_UUID%5D” was blocked because tracking protection is enabled.
The resource at “https://cm.g.doubleclick.net/pixel?google_nid=verticalmass_ddp&google_cm&google_sc&vuid=48fc4df75a9243e907b20e5993ed565f9daf49b3df207502918e13ada636bd70” was blocked because tracking protection is enabled.
The resource at “https://analytics.twitter.com/i/adsct?p_id=Twitter&p_user_id=0&txn_id=nvef1&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fwww.49ers.com%2Fvideo%2Fwho-will-be-jimmy-garoppolo-s-biggest-weapon-in-2018” was blocked because tracking protection is enabled.
The resource at “https://nflent-vh.akamaihd.net/i/films/2016/NFL_NETWORK/show/NFL_TOTAL_ACCESS/OFF/1/180710TA_Garoppolo_Expectations_1242692_,500k,1200k,3200k,700k,2000k,.mp4.csmil/master.m3u8” was blocked because tracking protection is enabled.
The resource at “https://nfl.hb.omtrdc.net/settings/f75c3025512d2c1d0a490d44-adobeorg.xml?r=1532083641863” was blocked because tracking protection is enabled.
The resource at “https://pagead2.googlesyndication.com/pagead/gen_204?request_type=xfp&admob=f&lid=6&sdkv=h.3.221.0&id=ima_html5&c=1365533056204536&domain=www.nfl.com” was blocked because tracking protection is enabled.
The resource at “https://pubads.g.doubleclick.net/gampad/ads?sz=640x360&ciu_szs=300x60%2C1x1&iu=%2F4595%2Fteam.sf%2Fvideo&gdfp_req=1&env=vp&output=xml_vast3&unviewed_position_start=1&cust_params=test%3D%26slot%3Dvideo%26s1%3Dvideo%26s2%3Dwho-will-be-jimmy-garoppolo-s-biggest-weapon-in-2018%26s3%3DNFLNetwork%26vid%3D239955&url=https%3A%2F%2Fwww.49ers.com%2Fvideo%2Fwho-will-be-jimmy-garoppolo-s-biggest-weapon-in-2018&description_url=https%3A%2F%2Fwww.49ers.com&correlator=3692607584297741&sdkv=h.3.221.0&sdki=3c0d&scor=1925343030276891&adk=1022348350&u_so=l&osd=2&frm=2&sdr=1&is_amp=0&adsid=NT&vpa=auto&vpmute=0&afvsz=200x200%2C250x250%2C300x250%2C336x280%2C450x50%2C468x60%2C480x70%2C728x90&ged=ve4_td2_tt0_pd2_la2000_er0.0.150.300_vi0.0.463.824_vp100_eb24427” was blocked because tracking protection is enabled.
The resource at “https://csi.gstatic.com/csi?v=2&s=ima&puid=1~jjtv1km8&c=7808894750689&alt=0&sdkv=h.3.221.0&pid=4595&mrd=4&aab=1&itv=1&aec=1012&rcid=goog_409590149&met.4=er.bi” was blocked because tracking protection is enabled.

So there were domains to test:
- www.googletagservices.com
- nflenterprises.tt.omtrdc.net
- cdn.taboola.com
- play.google.com
- nfl.demdex.net
- munchkin.marketo.net
- connect.facebook.net
- www.facebook.com
- static.chartbeat.com
- sb.scorecardresearch.com
- cdns.gigya.com
- adservice.google.ro 
- dpm.demdex.net
- srv-2018-07-20-10.config.parsely.com
- secure.adnxs.com
- tags.bluekai.com
- idsync.rlcdn.com
- pixel.mathtag.com
- cm.g.doubleclick.net
- analytics.twitter.com
- nflent-vh.akamaihd.net
- nfl.hb.omtrdc.net
- pagead2.googlesyndication.com
- pubads.g.doubleclick.net
- csi.gstatic.com

I opened the URL in a fresh browser profile (Firefox Nightly 63, uMatrix installed, normal mode) and loaded the page. The video is displayed but does not play.

I disabled the Spoof Referrer option in uMatrix and then WHITELISTED anvato.net, ahamaihd.net and nfl.com (including the frames). In this case the video plays.

The other resources and combination didn't help. 

[So in conclusion:]
- akamaihd.net is in the `Content` category [tp-content]
- anvato.net is not listed in Blacklist/Entitylist
- nfl.com is not listed in Blacklist/Entitylist

Comment 3

[Oana Arbuzov [:oanaarbuzov]]

Attachment: uMatrixResults.png

Added uMatrix results.

Comment 5

[Thomas Wisniewski [:twisniewski]]

The video on that page is working for me now with strict and basic protection on, so I'm closing this as worksforme.