1340895 - "SecurityError: The operation is unsecure" when loading fido.ca login page

Status: UNCONFIRMED

(Core :: Layout: Form Controls, defect)

Description

[Mark Côté [:mcote]]

When trying to log into fido.ca (a popular Canadian cell-phone service provider), the main page content fails to load.  The web console shows the following:

SecurityError: The operation is insecure.  server.html:13
	keys https://rogers-fido.janrainsso.com/static/server.html:13:515
	G https://rogers-fido.janrainsso.com/static/server.html:10:121
	v https://rogers-fido.janrainsso.com/static/server.html:9:215

I see a number of other bugs filed about SecurityErrors, but this page loads fine in the current Firefox release so it seems like a regression.

These are the other messages in the console, aside from Tracking Protection blocks:

SSO (Sun, 19 Feb 2017 17:04:21 GMT): checking for session  sso.js:5:451
Setting up event listener 1 remote  server.html:10:467
<SecurityError above>
check login not successful  capture:login:324:333
Navigated to https://www.fido.ca/pages/#/login?m=login

I disabled Tracking Protection in case it was interfering, but the result is the same.

Comment 1

[Mark Côté [:mcote]]

Hm, actually on this machine I'm also getting the error in version 51.0.1.  It did load fine on that version on another machine, though.  The only add-ons I have are the follows:

Min Vid
Page Shot
Tab Center
Test Pilot
Activity Stream (disabled)

Comment 2

[YF (Yang)]

WFM in 54.0a1 (2017-02-20) (32-bit), and with these add-ons.

Comment 3

[Loic]

Does it work in safe mode?
https://support.mozilla.org/t5/Procedures-to-diagnose-and-fix/Troubleshoot-Firefox-issues-using-Safe-Mode/ta-p/1687

With a fresh profile?
https://support.mozilla.org/t5/Install-and-Update/Use-the-Profile-Manager-to-create-and-remove-Firefox-profiles/ta-p/2914

Comment 4

[Mark Côté [:mcote]]

Does not work in safe mode.

Does work with a fresh profile.

Comment 5

[Vlad Bacia-Mociran [:VladB]]

User Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:54.0) Gecko/20100101 Firefox/54.0
User Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:51.0) Gecko/20100101 Firefox/51.0

I have tested your issue on latest Firefox release v51.0.1 and latest Nightly (Build ID: 20170221030205) and could not reproduce it. I have installed all add-ons from comment 1 and tried to login into fido.ca account. The logins was successfully made. I've tried on Chrome and also there were the Security errors but login was successfully made.

capture:login:324:333 - was displayed in the browser console when the username or password were wrong.

Can you please clear Cookies and Cache and retry? Also, please add a screenshot/video of how the website looks when it is not working compared to when all works ok.

Comment 6

[Mark Côté [:mcote]]

Cleared cookies and cache, issue persists.  I'll upload screenshots now.

Comment 7

[Mark Côté [:mcote]]

Attachment: Broken login page

Comment 8

[Mark Côté [:mcote]]

Attachment: Functional login page, from fresh profile

Comment 9

[Loic]

Mark, could you type about:support and copy all the add-ons table.

Comment 10

[Loic]

(with the broken profile ofc)

Comment 11

[Vlad Bacia-Mociran [:VladB]]

@Mark, thank you for the screenshots. It would be best to see also the URL in the screenshot because from what I can see fido.co has 2 URLs that point to login.

1. From Homepage http://www.fido.ca/ -> click on "Login/Register" button -> the user is redirected to https://www.fido.ca/pages/#/login?m=login and there is displayed the Login/Register form. For me all elements are loaded and there are no issues. (Screenshot from comment 8)

2. After the user has made a successful login -> click on "Logout" button. After this action, the user is redirected to https://www.fido.ca/pages/#/login and the login form is still displayed. If the URL is copied and pasted into a new tab, there will be no login form as in the picture from comment 7 .

Tried with Firefox latest release, latest Nightly, latest Beta and latest Dev edition with the add-ons from comment 1 and the only way to reach the state from comment 7 is the second scenario described in this comment. www.fido.ca loads without issues for me.

What OS are you using? Are there any other custom settings made to fido.ca profile, like language or region? Changes made to the browser prefs? Are you using other add-ons than the ones mentioned in comment 1 ?

Comment 12

[Mark Côté [:mcote]]

(In reply to Loic from comment #9)
> Mark, could you type about:support and copy all the add-ons table.

Extensions
Name 	Version 	Enabled 	ID
Application Update Service Helper	2.0	true	[e-mail]
FlyWeb	1.0.0	true	[e-mail]
Form Autofill	1.0	true	[e-mail]
Min Vid	0.3.4	true	@min-vid
Multi-process staged rollout	1.9	true	[e-mail]
Page Shot	5.2.201701261751	true	jid1-NeEaf3sAHdKHPA@jetpack
Pocket	1.0.5	true	[e-mail]
Presentation	1.0.0	true	[e-mail]
Shield Recipe Client	1.0.0	true	[e-mail]
Tab Center	1.29.0	true	[e-mail]
Test Pilot	1.1.1-dev-8b67799	true	@testpilot-addon
Web Compat	1.1	true	[e-mail]
WebCompat Reporter	1.0.0	true	[e-mail]
Activity Stream	1.4.1	false	@activity-streams

Comment 13

[Mark Côté [:mcote]]

Attachment: Broken login page

Here's the broken login page, with URL bar.  The URL is the same as in your point #1.

> What OS are you using? Are there any other custom settings made to fido.ca
> profile, like language or region? Changes made to the browser prefs? Are you
> using other add-ons than the ones mentioned in comment 1 ?

macOS 10.12.3.  No custom settings for fido.ca.  This is an older profile so I've made some changes to preferences (including some directly at about:config), but I wouldn't be able to tell you which might be interfering.  No other add-ons installed.

Comment 14

[Loic]

I suspect it's an issue with HSTS priming. With the issue on FF51, what's the value of security.mixed_content.send_hsts_priming in about:config?

If it's true, can you set to false and restart Firefox to test again.

Comment 15

[Mark Côté [:mcote]]

It was set to true, but setting it to false had no effect after restarting (issue persists).

Comment 16

[Vlad Bacia-Mociran [:VladB]]

In comment 13 I can see Tracking Protection icon in the URL bar but in comment 12

Comment 17

[Vlad Bacia-Mociran [:VladB]]

Tracking Protection is not listed. In Nightly I've enabled Tracking Protection from about:preferences#privacy, flash player was set to ask to activate but I couldn't repro the issue. I think that this issue is related to some custom changes from about:config. When running the profile in safe mode the add-ons are disabled but custom changes are kept. With the new profile all setting are set to default.