1235978 - Tracking protection basic breaks redditp.com

Status: ASSIGNED

(Core :: Privacy: Anti-Tracking, defect, P3)

Description

[ubershmekel]

User Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.106 Safari/537.36

Steps to reproduce:

1. New Private Window
2. Browse to http://redditp.com
3. See in the console  "The resource at "http://www.reddit.com/.json?jsonp=jQuery191009076678373860347_1451544464726&&_=1451544464727" was blocked because tracking protection is enabled."


Actual results:

Redditp failed to load ajax request of reddit links. A black screen with no slides is seen.


Expected results:

Seeing a presentation of images.

Comment 1

[ubershmekel]

This was the original report https://www.reddit.com/r/redditp/comments/3pyojr/is_anyone_else_getting_the_failed_ajax_error_for/

Comment 2

[08xjcec48]

It breaks this too: http://web.uforio.com/#r/worldnews

Comment 3

[Jamy Mahabier]

It also breaks http://reddpics.com/

Comment 4

[xvip10]

I recieve the same error on a website I am developing for the request https://www.reddit.com/api/v1/access_token?grant_type=https%3A%2F%2Foauth.reddit.com%2Fgrants%2Finstalled_client&device_id=DO_NOT_TRACK_THIS_DEVICE.

This should not be blocked because, acrodding to reddit,
> Clients that wish to remain anonymous should use the value DO_NOT_TRACK_THIS_DEVICE.

Comment 5

[Rebecca Billings [:rbillings]]

http://redditp.com/ still fails to load content on 58.0a1 with TP enabled.

Comment 6

[Oana Arbuzov [:oanaarbuzov]]

The issue is still reproducible and it is related to `trackingprotection` breakage.
It is reproducible while Tracking Protection BASIC is enabled.

[Environment:]
Browser / Version: Firefox Nightly 63.0a1 (2018-08-06)
Operating System: Windows 10 Pro
URL: http://redditp.com

Looking at the devtools console, here are the blocked resources:
The resource at “https://www.google-analytics.com/analytics.js” was blocked because tracking protection is enabled.
The resource at “https://www.reddit.com/.json?jsonp=jQuery22004023343830486257_1533648577411&&_=1533648577412” was blocked because tracking protection is enabled.

So below are the domains to test:
- www.google-analytics.com
- www.reddit.com

I opened the URL in a fresh browser profile (Firefox Nightly 63, uMatrix installed, normal mode) and loaded the page. The page is black.

I disabled the Spoof Referrer option in uMatrix and then WHITELISTED:
- reddit.com (including all related domains)
and the images in the slideshow ware not shown.

Since there was an error related to Ajax ("Failed ajax, Firefox try to disable tracking protection from the shield in the URL bar") I whitelisted:
- ajax.googleapis.com 
and the image were shown and slideshow started.

The other resource (www.google-analytics.com) didn't help. 

So in conclusion:
- reddit.com - Social = [tp-social]
- googleapis.com - Content = [tp-content]

----------------------------------------------------------------------------------------------------------------------------

[Note1:]
For URL: http://web.uforio.com/#r/worldnews: 
- whitelisting the `reddit.com` domain, the posts are loaded.

[Note2:]
For URL: http://reddpics.com/
- whitelisting the `reddit.com` and `ajax.googleapis.com` domains, the images are loaded.

Comment 7

[Oana Arbuzov [:oanaarbuzov]]

Attachment: Screenshot_1.png

Added uMatrix results for URL: ttp://redditp.com

Comment 8

[Oana Arbuzov [:oanaarbuzov]]

Attachment: Screenshot_2.png

Added uMatrix results for URL: http://web.uforio.com/#r/worldnews

Comment 9

[Oana Arbuzov [:oanaarbuzov]]

Attachment: Screenshot_3.png

Added uMatrix results for URL: http://reddpics.com/

Comment 11

[ubershmekel]

Is it true that the "turn off blocking for this site" button is gone in newer versions of Firefox?

https://github.com/ubershmekel/redditp/issues/73#issuecomment-527743988

Comment 12

[Thomas Wisniewski [:twisniewski]]

We will need to unblock/sandbox/proxy https://www.reddit.com/.json for this page to be able to load its content from Reddit.

Comment 13

[Wiktor]

I think this ticket could be generalized into "Tracking protection basic breaks any site interacting with Reddit API". Reddit has a nice CORS-compatible JSON API that works well from other browsers.

Whitelisting https://www.reddit.com/<anything>.json CORS calls would be a good idea. (For the record I'm also impacted: I'm developing a site that allows people to verify their social profiles)

Comment 14

[ubershmekel]

Another note about reddit's api is that there are a few endpoints that don't work with the CORS calls and only work with the JSONP calls. For example:

https://www.reddit.com/r/random/.json returns a 301 redirect to https://www.reddit.com/r/Arcade1Up/.json

This causes the CORS request to fail.

Comment 15

[Karl Dubost💡 :karlcow]

ETP Shims?

Comment 16

[Thomas Wisniewski [:twisniewski]]

In this case shims might be able to at least provide an opt-in placeholder, like a click-to-play user interface. We're investigating how to implement such a feature, and I'll update here as that investigation progresses.

Comment 17

[Oana Arbuzov [:oanaarbuzov]]

In private window the issue is still reproducible with ETP - Standard and Strict.
https://prnt.sc/exOdaVIHuz8n

In normal windows the issue is reproducible only with ETP - Strict.
https://prnt.sc/Uj6P9b3i5Wnh

Tested with:
Browser / Version: Firefox Nightly 101.0a1 (2022-04-07)
Operating System: Windows 10 Pro

Comment 18

[BugBot [:suhaib / :marco/ :calixte]]

In the process of migrating remaining bugs to the new severity system, the severity for this bug cannot be automatically determined. Please retriage this bug using the new severity system.

Comment 19

[Raul Bucata]

I can confirm that this breaks with ETP set to STRICT, in Normal Mode, and with ETP set to STANDARD in PRIVATE Mode.

Tom, since the behavior is different here, can we move this issue to the relevant Component?

Tested with:

Browser / Version: Firefox Nightly 110.0a1 (2023-01-11) (64-bit) Chrome Version 109.0.5414.75 (Official Build) (64-bit)
Operating System: Windows 10 PRO x64

Comment 20

[Thomas Wisniewski [:twisniewski]]

Yes, done. Thanks Raul!