1475529 - Unable to sign in/register account on www.harley-davidson.com while Tracking Protection strict is enabled

Status: RESOLVED WORKSFORME

(Web Compatibility :: Site Reports, defect, P5)

Description

[Oana Arbuzov [:oanaarbuzov]]

Attachment: AffectedArea.txt

[Environment:]
Browser / Version: Firefox Nightly 62.0a1 (2018-07-11)
Operating System: Windows 10 Pro

[Steps to Reproduce:]
    1. Navigate to https://www.harley-davidson.com/shop/mens-motorcycle-clothes 
    2. Click the “Sign in” button.
    3. Select “Sign in” option.
    4. Observe behavior.
        
[Expected Behavior:]
The “Login” overlay is displayed.
 
[Actual Behavior:]
Nothing happens, the “Login” overlay is not displayed.

[Note:]
    1. Reproducible also for “Register” option.
    2. Not reproducible with Tracking Protection basic.

Comment 1

[Oana Arbuzov [:oanaarbuzov]]

Looking at the devtools console, here are the blocked resources:
The resource at “https://se.monetate.net/js/2/a-2535297b/p/harley-davidson.com/entry.js” was blocked because tracking protection is enabled.[Learn More] mens-motorcycle-clothes
The resource at “https://tags.bkrtx.com/js/bk-coretag.js” was blocked because tracking protection is enabled.[Learn More] mens-motorcycle-clothes
The resource at “https://libs.coremetrics.com/eluminate.js” was blocked because tracking protection is enabled.[Learn More] mens-motorcycle-clothes
The resource at “https://assets.adobedtm.com/dea66dda64873ee103a825b11f01324924689d32/satelliteLib-9796eb96024c431db5e76b60fcd5b1b62f5eaf07.js” was blocked because tracking protection is enabled.[Learn More] mens-motorcycle-clothes
The resource at “https://s.go-mpulse.net/boomerang/7KGT2-WV6WZ-J2T9H-7NEA3-52XMC” was blocked because tracking protection is enabled.[Learn More] mens-motorcycle-clothes
The resource at “https://www.google-analytics.com/analytics.js” was blocked because tracking protection is enabled.[Learn More] mens-motorcycle-clothes
The resource at “https://cdns.gigya.com/js/gigya.js?apikey=3_Gqzd0zsUdMuS9EkGrPWmFOM3hIuPd3-BK9O7b40IWZO9bkh_-I1E11vDJQFU3nOt&lang=en&_=1531414472232” was blocked because tracking protection is enabled.[Learn More] mens-motorcycle-clothes
The resource at “https://bs.serving-sys.com/BurstingPipe/ActivityServer.bs?cn=as&ActivityID=309687&rnd=570101.2909753271” was blocked because tracking protection is enabled.[Learn More]

So there were domains to test:
- se.monetate.net
- tags.bkrtx.com
- libs.coremetrics.com
- assets.adobedtm.com
- tags.bkrtx.com
- s.go-mpulse.net
- www.google-analytics.com
- cdns.gigya.com
- bs.serving-sys.com

I opened the URL in a fresh browser profile (Firefox Nightly 63, uMatrix installed, normal mode), loaded the page and tried to sign in/create account.

I disabled the Spoof Referrer option in uMatrix and then whitelisted different combination of the domains. 
In the end I whitelisted:
- gigya.com (including all the linked domains and frames cdns.gigya.com) 
and the "Log in" overlay was displayed was displayed. 

So in conclusion:
- gigya.com – Content = [tp-content]


François could you confirm my findings?

Comment 2

[Oana Arbuzov [:oanaarbuzov]]

Attachment: uMatrixWhitelistedDomain.png

Added uMatrix results.

Comment 3

[François Marier [:francois]]

That looks great Oana, thanks!

As a minor point, I'd suggest putting just "gigya.com" in the user story field (instead of "cdns.gigya.com") since that's what's in the Disconnect list: https://github.com/mozilla-services/shavar-prod-lists/blob/f16248d7f33367bb3c48d72fb32fdb239dbe0c8e/disconnect-blacklist.json#L6677

Comment 4

[Thomas Wisniewski [:twisniewski]]

I'm able to create an account and/or log in while using strict mode on the most recent nightly build, so this ought to be fixed now.