1174797 - handle OAuth not working with cookies/javascript disabled

Status: NEW

(MailNews Core :: Networking: IMAP, defect)

Description

[Kent James (:rkent)]

See  for example: http://mxr.mozilla.org/comm-central/source/calendar/providers/gdata/modules/gdataSession.jsm#181

Comment 1

[Wayne Mery (:wsmwk)]

I think you want tracking esr

Comment 2

[Kent James (:rkent)]

Right.

Comment 3

[Magnus Melin [:mkmelin]]

Context: if you disabled cookies, trying to do OAuth2 authentication for gmail will show a "Oops! Your browser seems to have cookies disabled. Make sure cookies are enabled or try opening a new browser window. [?] " message in the OAuth dialog. 

I'm not so sure it's ok to add it silently though, as that lets google track you elsewhere (to a limited extent) - which is probably one of the reasons you disabled cookies in the first place.

Comment 4

[aleth [:aleth]]

(In reply to Magnus Melin from comment #3)
> Context: if you disabled cookies, trying to do OAuth2 authentication for
> gmail will show a "Oops! Your browser seems to have cookies disabled. Make
> sure cookies are enabled or try opening a new browser window. [?] " message
> in the OAuth dialog. 

Also, even if cookies are enabled, if you have two different google oauth accounts, there may be conflicts (at least this has happened for twitter). For twitter, the cookies are removed once oauth is complete, cf. https://dxr.mozilla.org/comm-central/source/chat/protocols/twitter/twitter.js#866.

> I'm not so sure it's ok to add it silently though, as that lets google track
> you elsewhere (to a limited extent) - which is probably one of the reasons
> you disabled cookies in the first place.

Cleaning up the cookies on completion would also help with that issue.

Comment 5

[.m]

i would prefer sticking to imap only or making oauth opt-in. i have disabled google 2-factor-authentication for a reason. Adding a cookie exception for gmail seems to be violating privacy by design principles.

Comment 6

[Matt]

How about we offer to enable the cookies for gmail instead of just telling the user they need to. That meets both requirements for user choice and good user experience.

Comment 9

[Wayne Mery (:wsmwk)]

related bugs https://mzl.la/3nXgckB

Comment 12

[Wayne Mery (:wsmwk)]

(In reply to Matt from comment #6)

How about we offer to enable the cookies for gmail instead of just telling the user they need to. That meets both requirements for user choice and good user experience.

Comment 14

[Wayne Mery (:wsmwk)]

What do you think about putting resolving this on the plate for the next version?

Ref https://www.reddit.com/r/Thunderbird/comments/p39sau/does_gmail_oauth_work/

Comment 15

[Matt]

On reflection, I think we should offer to enable cookies yes or no, rather than just the ones for Gmail. While those servers currently used is reasonably well known, they are not part of some API that Google publish and are probably subject to change without notice. A maintenance issue going forward.

I think just offer to enable everything. If the user want to restrict the cookies to a particular server or set of servers, that should be something they do manually after saying no to enabling cookies.