1411710 - Unable to load Gmail after Nightly update with security.webauth.u2f = true

Status: RESOLVED FIXED

(Core :: DOM: Device Interfaces, defect, P2)

Description

[:Atoll]

I updated to 2017-10-25 Nightly, and Gmail doesn't load anymore. Freezes in the progress bar at about 85%.

I was able to dig up from the POST to /jserror:

script=https://mail.google.com/_/scs/mail-static/_/js/k=gmail.main.en.Kkobh6whZGg.O/m=pds,pdl,pdit,m_i,pdt,t,it/am=[redacted]/rt=h/d=1/rs=[redacted]
error=u2f is not a function
line=2861
txz=p

Perhaps I need to (or already did) enable U2F support for testing? Perhaps Gmail is assuming U2F is available, without testing correctly?

cc :ttaubert (u2f), :karlcow (webcompat)

Comment 1

[:Atoll]

security.webauth.u2f = true in my about:config. Resetting to false lets me login to Gmail again.

Comment 2

[Tim Taubert [:ttaubert] (inactive)]

Hmm, I encountered the same problem this morning. I've had the pref enabled for a while, looks like that's a recent change in Gmail then?

Comment 3

[J.C. Jones [:jcj] (he/they)]

Yes, I had this happen all-of-a-sudden last night, so there must have been a deploy at Gmail.

Previous to yesterday the error we'd see was:

> TypeError: setting getter-only property "u2f" [Learn More]

from when Gmail would load this line: https://github.com/google/u2f-ref-code/blob/2efd344c23ac3ce57731ecd57ae57e8c26af6485/u2f-gae-demo/war/js/u2f-api.js#L17

Sadly, the U2F standard doesn't specify much of anything about how the `u2f` object works -- ours is not replaceable, being implemented in C++, while IIUC Google's is implemented by that u2f-api.js file.

I'm too pre-coffee to formulate a response here.

Comment 4

[:Atoll]

(Note that for me, this occurred in 58.0a1, but I assume it's also breaking in 57 which I didn't personally test.)

Comment 5

[J.C. Jones [:jcj] (he/they)]

Yes, this affects Firefox 57 for me, though the change to Gmail appears to be rolling out to a subset of profiles - my personal Gmail doesn't have the issue.

Since U2F support is experimental and disabled by default, I'm changing the flags to "disabled" so as to not cause relman any undue concern. We might want to consider uplifting our fix here if it's simple, but it is getting pretty late in the game for 57.

Comment 6

[Phabricator Automation]

Comment on attachment 8922314 [details]
Bug 1411710 - Denote window.u2f as a replaceable attribute r=jcj,smaug

J.C. Jones [:jcj] has approved the revision.

https://phabricator.services.mozilla.com/D166#4008

Comment 7

[Phabricator Automation]

Comment on attachment 8922314 [details]
Bug 1411710 - Denote window.u2f as a replaceable attribute r=jcj,smaug

J.C. Jones [:jcj] has requested changes to the revision.

https://phabricator.services.mozilla.com/D166#4011

Comment 8

[J.C. Jones [:jcj] (he/they)]

This appears to be fixed for me as of now; I checked yesterday and it was still broken. Presumably this would have been a fix at the Gmail side.

Comment 9

[Tim Taubert [:ttaubert] (inactive)]

Not seeing this anymore either.

Comment 10

[Tim Taubert [:ttaubert] (inactive)]

Hmmm, this seems to be back. It's again "u2f is not a function" that's sent to gmail.com/jserror.

Comment 11

[JR Conlin [:jrconlin,:jconlin]]

confirming that this is a problem with current nightly on windows and linux and that disabling u2f resolves it.

Comment 12

[Xavier]

Same problem with release version (57.0). Confirming that disabling u2f solve this.

Comment 13

[:Atoll]

For triage purposes, this issue only occurs when a default-off preference is manually enabled, and will not affect the vast majority of users unless that preference is switched to default-on while this issue remains extant.

Comment 15

[J.C. Jones [:jcj] (he/they)]

As an update: I've spoken with the Identity and Security PM at Google about this issue and they're working on it on their side. Tim and I have been also talking about whether there's something we could do with a WebExtension to blacklist Gmail temporarily.

Comment 16

[Tim Taubert [:ttaubert] (inactive)]

Seems to work again for me. Can anyone confirm?

Comment 17

[Xavier]

Yes, it also works for me.

Comment 18

[:Atoll]

(Per comment 8 and 10, I’ll wait a couple days before re-checking to ensure it’s not a temporary thing.)

Comment 19

[JR Conlin [:jrconlin,:jconlin]]

Confirming that it works again.

Comment 21

[semeano]

I have the same issue on this page: https://www.myetherwallet.com/
If I set security.webauth.u2f = true it doesn't load.

Here's the console error:

TypeError: setting getter-only property "u2f"
Error: [$injector:modulerr] Failed to instantiate module mewApp due to:
[$injector:nomod] Module 'mewApp' is not available! You either misspelled the module name or forgot to load it. If registering a module ensure that you specify the dependencies as the second argument.
http://errors.angularjs.org/1.6.5/$injector/nomod?p0=mewApp

FirefoxNightly 59.0a1 (2017-12-12) (64-bit)

Comment 22

[:Atoll]

My original issue was resolved later on and I no longer have the problem reported at Gmail. Feel free to reopen if there's further actionable desires here.