1384657 - Pocket doesn't work with privacy.firstparty.isolate set to true

Status: RESOLVED FIXED

(Firefox :: Pocket, defect, P3)

Description

[Benson Wong [:mostlygeek]]

With the pref: privacy.firstparty.isolate=true, clicking the pocket button on the toolbar will bring to getpocket.com and your list. 

The expected behavior is for pocket to actually add the page to my list.

Comment 1

[:Gijs (he/him)]

Tom, do you know (someone who knows) why this would be?

(De-prio'ing as this isn't going to hit many people and this has shipped for a while now.)

Comment 2

[Tom Ritter [:tjr]]

I don't know personally, but I'm adding the team who can figure it out.

Comment 3

[Ethan Tseng [:ethan]]

(In reply to Tom Ritter [:tjr] from comment #2)
> I don't know personally, but I'm adding the team who can figure it out.

Thanks, Tom!

Tim, please look into this bug to see how we can fix the problem.
Thanks.

Comment 4

[Tim Huang[:timhuang]]

I cannot reproduce the same issue that comment 0 describes, but I did find something wrong here. Pocket won't save the page if the first party isolation is enabled. 

STR:
1. Turn on the pref 'privacy.firstparty.isolate'.
2. Login the pocket either by clicking the pocket button or visiting the website.
3. Open any page that you are ready to save.
4. Click the pocket button.

Expected behavior:
  Pocket adds the page.

Actual behavior:
  The pocket panel shows up as non-login and the page is not saved.

The root cause of this problem is that Pocket is using the default originAttributes, but the login cookies will be put under originAttributes {firtPartyDomain: "getpocket.com"} when first party isolation is enabled. So, Pocket cannot access the cookies which leads to this issue.

Benson, is this the same STR of the problem you reported. If it is not, could you provide details of how to reproduce the problem you encountered, Thanks.

Comment 5

[Benson Wong [:mostlygeek]]

I tried reproducing on FF57.0b4 and could not. 
With privacy.firstparty.isolate = true, I was able to add pages to my pocket.

Comment 6

[Tom Ritter [:tjr]]

If Benson can't repro, going to mark this as fixed.

Comment 7

[sslanec]

I'm still getting this bug on Firefox 59. When I first enabled first party isolation, Pocket seemed to work fine. However, it broke after clearing all of my cookies and I can't get it working again. I think you need to clear your cookies in order to properly reproduce the problem.

Comment 8

[Tom Ritter [:tjr]]

(In reply to sslanec from comment #7)
> I'm still getting this bug on Firefox 59. When I first enabled first party
> isolation, Pocket seemed to work fine. However, it broke after clearing all
> of my cookies and I can't get it working again. I think you need to clear
> your cookies in order to properly reproduce the problem.

This sounds like Pocket is retrieve cookies from your default cookie jar and ignoring FPI.  Thus when you set FPI to on, things still work; but if you clear your cookies; things will break.

Comment 9

[Daniel]

I’m also seeing this exact same problem on Firefox 60. It works if I login to Pocket as the first thing I do in a new profile. However, I can’t first enable first-party isolation and then login to Pocket.

Comment 10

[Tom Ritter [:tjr]]

So this isn't a bug with FPI; it's a bug with Pocket's session handling code. I'm going to try to figure out how to get this to Pocket...

Comment 11

[Matt Koidin]

Tom - Thanks for sending over. I think this initially came through before we had good clarity on triaging Pocket issues in Bugzilla. Adding Justin Rochell from our team who takes the lead on triaging and might have some additional questions.

Comment 12

[Justin Rochell]

Thanks for the ping. 

Yep, we've been tracking this. Users occasionally encounter this issue when they enable First Party Isolation and try to use Pocket.

Tom - could you please outline your findings with our session handling code? I'm happy to make sure it gets into the proper hands.

Comment 13

[Tom Ritter [:tjr]]

(In reply to Justin Rochell from comment #12)
> Thanks for the ping. 
> 
> Yep, we've been tracking this. Users occasionally encounter this issue when
> they enable First Party Isolation and try to use Pocket.
> 
> Tom - could you please outline your findings with our session handling code?
> I'm happy to make sure it gets into the proper hands.

A really cursory search of 'cookie' in pocket turns up https://searchfox.org/mozilla-central/rev/3737701cfab93ccea04c0e9cab211ad10f931d87/browser/extensions/pocket/content/pktApi.jsm#157

I think you would want to update that to look to see if FPI is currently enabled; and if so, to pass in OriginAttributes data to retrieve the Pocket Cookies from FPI.  This means that the user will be logged out of Pocket when they turn on FPI; but they're logged out of everything else so it will probably be normal to them.

Comment 15

[Avinash Sonawane]

Experiencing this issue on Firefox Developer Edition 65.0b4. When FPI is enabled can't save page to Pocket even if already logged in to Pocket.

Screenshot: https://i.imgur.com/H0w0EFb.png

Comment 16

[Ethan Tseng [:ethan]]

Tim, we need to re-investigate this issue. Please take a look when you have time.

Comment 17

[Tom Ritter [:tjr]]

Since I haven't seen any indication otherwise, I believe the issue is still in Pocket's court to fix; per Comment 13.

Comment 18

[:Gijs (he/him)]

Attachment: Bug 1384657 - fix pocket when cookie first party isolation has been turned on, r?tjr!,thecount!

Comment 19

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/623fa9efc465
fix pocket when cookie first party isolation has been turned on, r=tjr,thecount

Comment 20

[Eliza Balazs [:ebalazs_]]

https://hg.mozilla.org/mozilla-central/rev/623fa9efc465