1357725 - Break auth on https://addons.mozilla.org

Status: RESOLVED FIXED

(addons.mozilla.org :: Security, defect, P3)

Description

[Tester]

Hi team,

I noticed an authentication break at https://addons.mozilla.org

POC

1 access https://accounts.firefox.com on two devices> when the password is changed on one of the devices the session is immediately interrupted on the other device

2 access https://accounts.firefox.com and on another device https://addons.mozilla.org (https://addons.mozilla.org uses the same credentials as https://accounts.firefox.com)> Change your account password at https://accounts.firefox.com> the session remains active at https://addons.mozilla.org

In this scenario I am using a valid session at https://addons.mozilla.org from a different password.

Please check it.

Comment 1

[Simon Bennetts [:psiinon]]

Stuart: is this working as expected? From previous conversations (and while not ideal) I think it probably is.

Comment 2

[Stuart Colville [:muffinresearch]]

(In reply to Simon Bennetts [:psiinon] from comment #1)
> Stuart: is this working as expected? From previous conversations (and while
> not ideal) I think it probably is.

Yes I would agree, sessions on AMO are independent of FXA and FXA doesn't provide a way to notify AMO of password changes so we cannot currently invalidate a session in AMO if the password is changed in FXA.

Comment 3

[Daniel Veditz [:dveditz]]

Sounds like a dupe of all the bugs on the fact that AMO is using client session auth.

Comment 4

[Stuart Colville [:muffinresearch]]

Andrew can you check if FXA supports sending something (SQS or webhook) based on password changes?

Comment 6

[Andrew Williamson [:eviljeff]]

It's supported as a webhook https://github.com/mozilla/fxa/tree/master/packages/fxa-event-broker#password-change
I'm assuming it's available in SQS too (I'm not sure there is up to date documentation as it's been superseded by webooks).

Comment 7

[Tester]

Hi,

This is eligible for one bounty?

Comment 8

[Andreas Wagner [:TheOne] [use NI]]

In comment 3, the team decided it is not eligible for a bounty.

Comment 9

[Andrew Williamson [:eviljeff]]

https://github.com/mozilla/addons-server/issues/14730 is the github issue for implementing webhook notifications, including password changes.

Comment 10

[Andrew Williamson [:eviljeff]]

https://bugzilla.mozilla.org/show_bug.cgi?id=1730485 was about this (and is now closed)