1262897 - Remove FxA postMessage ping auth

Status: RESOLVED FIXED

(www.mozilla.org :: Pages & Content, defect)

Description

[Jonathan Petto [:jpetto]]

After bug 1262892 has landed and is verified on the FxA side, we should remove the then deprecated postMessage + ping iframe auth, which currently exists on /firefox/firstrun/ [1] and /firefox/accounts/ [2].

[1] https://github.com/mozilla/bedrock/blob/master/media/js/firefox/firstrun/firstrun.js#L32-L35
[2] https://github.com/mozilla/bedrock/blob/master/media/js/firefox/accounts.js#L95-L97

Comment 1

[Hector Zhao [:hectorz]]

(In reply to Jon Petto [:jpetto] from comment #0)
> After bug 1262892 has landed and is verified on the FxA side, we should
> remove the then deprecated postMessage + ping iframe auth, which currently
> exists on /firefox/firstrun/ [1] and /firefox/accounts/ [2].

Hello Jon,

Before removing it, please give us at Beijing office some time to upgrade https://accounts.firefox.com.cn/, the fxa servers seen by users of Fx China repacks. Thanks!

Comment 2

[Hector Zhao [:hectorz]]

(In reply to Hector Zhao [:hectorz] from comment #1)
> Before removing it, please give us at Beijing office some time to upgrade
> https://accounts.firefox.com.cn/, the fxa servers seen by users of Fx China
> repacks. Thanks!

https://accounts.firefox.com.cn/ was upgraded to train-68 a few hours ago. We'll test against https://www-dev.allizom.org/ when the removal is merged into master and let you know if everything works for us, thanks for the patience!

Comment 3

[Eric Renaud [:erenaud]]

Jon - can you please have a look and provide status?

Comment 4

[Jonathan Petto [:jpetto]]

:stomlinson - Has the switch away from using the ping postMessage for authentication been completed on the FxA side? Is it time to remove the (now or soon to be) out of date ping postMessage handling from mozilla.org?

Comment 5

[Shane Tomlinson [:stomlinson]]

:jpetto - indeed it has. Sorry for not notifying you! You can remove the `ping` postMessage code.

Comment 6

[Jonathan Petto [:jpetto]]

:hectorz - What do you see as the best way to roll out this change? Once we merge to master in bedrock, the change will automatically be sent to www-dev.allizom.org. However, it will also be pushed live whenever the next release is tagged (which is unpredictable, given the number of updates regularly made to mozilla.org).

I'm happy to go with the above scenario - we could coordinate a time to merge the PR and can probably keep an hour or so window open for you to test against www-dev.allizom.org. Alternatively, or in addition, I can file a PR and let you review prior to merge so you can see what the changes will look like.

Let me know what you think.

Comment 7

[Jonathan Petto [:jpetto]]

:hectorz - Just opened a pull request for the changes:

https://github.com/mozilla/bedrock/pull/4349

Take a look at let me know what you think about timing the merge/push.

Comment 8

[Hector Zhao [:hectorz]]

(In reply to Jon Petto [:jpetto] from comment #7)
> :hectorz - Just opened a pull request for the changes:
> 
> https://github.com/mozilla/bedrock/pull/4349
> 
> Take a look at let me know what you think about timing the merge/push.

Hi :jpetto

I was out during the Chinese public holidays, sorry for the delay in response.

I've tested the PR locally, and everything works as expected. About the timing, I think either 8-10am CDT (Mon-Fri) or 5-6pm CDT (Mon-Thu) works for me. Please NI both me and Bingqing (CC-ed).

Thanks!

Comment 9

[Jonathan Petto [:jpetto]]

:hectorz - The PR has been reviewed and approved, so we're ready to merge when you are. We can do a push between 5pm and 6pm CDT today (so, in about 75 minutes), but if that's too soon, we can hold off until tomorrow (Friday, 9/23) or Monday 9/26.

Ping me here or in #www with your preferred time.

Thanks!

Comment 10

[Hector Zhao [:hectorz]]

(In reply to Jon Petto [:jpetto] from comment #9)
> :hectorz - The PR has been reviewed and approved, so we're ready to merge
> when you are. We can do a push between 5pm and 6pm CDT today (so, in about
> 75 minutes), but if that's too soon, we can hold off until tomorrow (Friday,
> 9/23) or Monday 9/26.

Sorry I didn't see the bugmail in time. How about 8-10am Friday 23rd?

Comment 11

[Hector Zhao [:hectorz]]

(In reply to Hector Zhao [:hectorz] from comment #10)
> 
> Sorry I didn't see the bugmail in time. How about 8-10am Friday 23rd?

I should've considered the demo servers earlier. I just realized the PR is now deployed at demo4. With a configuration change on our side I can confirm the fxa iframe loads https://accounts.firefox.com.cn w/o problems in Fx China repack.

I think there's no need to block the merge on our verification test any more. Thanks for getting us involved!

Comment 12

[[github robot]]

Commits pushed to master at https://github.com/mozilla/bedrock

https://github.com/mozilla/bedrock/commit/1fd3564f0b62ebfdc9ff651ee0bc112ecc7081c5
[fix bug 1262897] Remove deprecated FxA ping auth

https://github.com/mozilla/bedrock/commit/d2b66479d22d67db12750ed80090106c803c7159
Merge pull request #4349 from jpetto/bug-1262897-remove-fxa-ping-auth

[fix bug 1262897] Remove deprecated FxA ping auth

Comment 13

[Bingqing Li]

We finished the test against www-dev.allizom.org, and everything works fine.