1336465 - [FirstPartyIsolation] Unable to login using Facebook on Sabah.com.tr

Status: RESOLVED WORKSFORME

(Core :: DOM: Security, defect, P3)

Description

[Bogdan Maris [:bogdan_maris], Desktop QA]

[Affected versions]:
- Firefox 52 beta 2
- latest Dev Edition 53.0a2
- latest Nightly 54.0a1

[Affected platforms]:
- macOS 10.12.2
- Ubuntu 16.04 32-bit
- Windows 10 64-bit

[Steps to reproduce]:
1. Visit Sabah.com.tr and login using Facebook

[Expected result]:
- Login is successful.

[Actual result]:
- User was not successfully logged in with Facebook account.

[Regression range]:
- This is not a regression.

Comment 1

[Cynthia Tang [:cynthiatang]]

Hi Bogdan, 
Could you please set the preference "privacy.firstparty.isolate.restrict_opener_access" to be "false" and try it in Nightly 54.0a1 again? Thank you!

Comment 2

[Ethan Tseng [:ethan]]

(In reply to Cynthia Tang [:cynthiatang] from comment #1)
> Hi Bogdan, 
> Could you please set the preference
> "privacy.firstparty.isolate.restrict_opener_access" to be "false" and try it
> in Nightly 54.0a1 again? Thank you!

Bogdan,
Also we don't need to track this series of bugs for Firefox 52 and 53.
1. These are not actual bugs because the behavior in Firefox is correct (just not consistent with Tor).
2. The pref privacy.firstparty.isolate is off by default.  It does not affect normal users.

So, could you turn off the tracking flags status-firefox52 and status-firefox53 for these bugs?
Thanks.

Comment 3

[Bogdan Maris [:bogdan_maris], Desktop QA]

(In reply to Cynthia Tang [:cynthiatang] from comment #1)
> Hi Bogdan, 
> Could you please set the preference
> "privacy.firstparty.isolate.restrict_opener_access" to be "false" and try it
> in Nightly 54.0a1 again? Thank you!

I tried again using latest Nightly across platforms and this time, the behavior of Fx with FPI matches Tor browser.

(In reply to Ethan Tseng [:ethan] from comment #2)
> (In reply to Cynthia Tang [:cynthiatang] from comment #1)
> > Hi Bogdan, 
> > Could you please set the preference
> > "privacy.firstparty.isolate.restrict_opener_access" to be "false" and try it
> > in Nightly 54.0a1 again? Thank you!
> 
> Bogdan,
> Also we don't need to track this series of bugs for Firefox 52 and 53.
> 1. These are not actual bugs because the behavior in Firefox is correct
> (just not consistent with Tor).
> 2. The pref privacy.firstparty.isolate is off by default.  It does not
> affect normal users.
> 
> So, could you turn off the tracking flags status-firefox52 and
> status-firefox53 for these bugs?
> Thanks.

You are right, I'll remove the tracking flags for 52 and 53.