1454519 - Cookie is sticky (does not get deleted) since a few days in Firefox nightly, on certain sites

Status: RESOLVED WORKSFORME

(Core :: Networking: Cookies, defect)

Description

[Guillaume Destuynder [:kang] [this account is no longer active]]

This is something that can be reproduced on Mozilla properties if you have a login, such as: https://mozdef.private.scl3.mozilla.com/.

It happens on 61.0a1 (2018-04-16) (64-bit) Firefox Nightly. It does not happen on Dev edition, Release, Chrome, or Firefox Nightly from 2018-04-06. I'm not sure at which version *exatly* this started occuring. Several colleagues can reproduce the problem as well.

Expected flow:

- load the page, where the site (here, mozdef.private.scl3.mozilla.com) sets a cookie
- the site 302 to auth0 to perform user authentication
- auth0 302 back to mozdef.private.scl3.mozilla.com
- firefox presents the cookie in the request headers to mozdef.private.scl3.mozilla.com
- login is completed.

What happens at the moment:

- firefox presents an older cookie in the request headers to mozdef.private.scl3.mozilla.com
- mozdef.private.scl3.mozilla.com refuses login because it cannot lookup this cookie value in it's local table

Here's an extract of what I can see through the Network tab in the dev tools:


## Firefox requests mozdef.private.scl3.mozilla.com/logout
### Response headers
Note the `session=` cookie (unset)

```
HTTP/1.1 302 Moved Temporarily
Server: openresty/1.13.6.1
Date: Mon, 16 Apr 2018 22:55:09 GMT
Content-Type: text/html
Content-Length: 167
Connection: keep-alive
Set-Cookie: session=; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; Path=/; SameSite=Lax; Secure; HttpOnly
Location: https://mozdef.private.scl3.mozilla.com
```

## Right after (as per Location: ) Firefox requests mozdef.private.scl3.mozilla.com/
### Request headers
Note how `session` cookie is set in the request even thus it was requested to be unset by previous request response (sticky) (note this cookie is no longer valid so i left it's value in)

```
GET / HTTP/1.1
Host: mozdef.private.scl3.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:61.0) Gecko/20100101 Firefox/61.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://auth.mozilla.auth0.com/login?client=E2Y8ZO8wkm0wlFq6vUrht9c2QEjKUNdA&protocol=oauth2&redirect_uri=https%3A%2F%2Fmozdef.private.scl3.mozilla.com%2Fredirect_url&response_type=code&nonce=REDACTED&scope=openid%20email%20profile&state=REDACTED
Cookie: session=p9F473jsmyNQCPynXTTyYg..|1524524102|twr_UWO91UQ0qfVSuCJLjVlpUAk.
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
```
### Response headers
Note the set-cookie here again
(note this cookie is no longer valid so i left it's value in)

```
HTTP/1.1 302 Moved Temporarily
Server: openresty/1.13.6.1
Date: Mon, 16 Apr 2018 22:55:09 GMT
Content-Type: text/html
Content-Length: 167
Connection: keep-alive
Set-Cookie: session=nGlNBxl8Hrum5jZEMGFHMw..|1524524109|NNXlvMp8mjguXeWtshxYSgD5xbk.; Expires=Mon, 23 Apr 2018 22:55:09 GMT; Max-Age=604800; Path=/; SameSite=Lax; Secure; HttpOnly
Location: https://auth.mozilla.auth0.com/authorize?response_type=code&client_id=E2Y8ZO8wkm0wlFq6vUrht9c2QEjKUNdA&state=REDACTED&redirect_uri=https%3A%2F%2Fmozdef.private.scl3.mozilla.com%2Fredirect_url&nonce=REDACTED&scope=openid%20email%20profile
```

Firefox then goes to auth.mozilla.auth0.com which eventually 302 back to mozdef.private.scl3.mozilla.com and a cookie:
`Cookie: session=p9F473jsmyNQCPynXTTyYg..|1524524102|twr_UWO91UQ0qfVSuCJLjVlpUAk.` instead of the cookie set in the previous request (`Set-Cookie: session=nGlNBxl8Hrum5jZEMGFHMw..|1524524109|NNXlvMp8mjguXeWtshxYSgD5xbk.; Expires=Mon, 23 Apr 2018 22:55:09 GMT; Max-Age=604800; Path=/; SameSite=Lax; Secure; HttpOnly`)

This, of course, causes mozdef.private.scl3.mozilla.com to send the user back to "try to login again" because it can't find the old cookie in it's local table of cookies.

Comment 1

[Johann Hofmann [:johannh]]

It would be very helpful if you could use mozregression to find a regression range (https://mozilla.github.io/mozregression/).

Thanks!

Comment 2

[Guillaume Destuynder [:kang] [this account is no longer active]]

20180420100056 has fixed this \o/ should i run regression regardless?

Comment 3

[Johann Hofmann [:johannh]]

Yeah, sorry, slow to reply right now, WORKSFORME seems good.