1561542 - Autoconfiguration impossible for ISPs providing OAuth2 when JavaScript is disabled

Status: RESOLVED WONTFIX

(Thunderbird :: Account Manager, defect)

Description

[u]

User Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.75 Safari/537.36

Steps to reproduce:

1. Start the autoconfig wizard for [e-mail] (must be a valid
   one that you have the password for).
2. Due to its priority, Mozilla's database will win over other
   methods, and its first pick is OAuth2 so that's what you get (but
   the authentication method is not displayed unless you click the
   "Manual config" button).
3. Just pick any of the results (IMAP or POP).
4. A browser window will open, asking you to login to the Google
   account, so enter [e-mail] and its password.
5. Observe the error message stating that you need to enable JavaScript.
6. Closing that browser window brings you back to the result screen
   from step 2, but now it says "the username or password is wrong".
7. No matter what you try autoconfiguration is unable to closer to a
   working configuration than step 6. The only solution is for the
   user to click "Manual config" and change authentication method for
   both server types.

Expected results:

For many providers JavaScript is required for OAuth2 to work. If
JavaScript is disabled the autoconfiguration UX may be
inconsistent/confusing (the error handling is on the provider's side) and difficult to recover from (the user has to manually alter the authentication method).

It should be possible to disable OAuth when using Thunderbird with Javascript disabled.

Comment 1

[u]

Attachment: Add-pref-for-whether-we-accept-OAuth2-during-autocon.patch

Comment 2

[Magnus Melin [:mkmelin]]

Comment on attachment 9074142 [details] [diff] [review]
Add-pref-for-whether-we-accept-OAuth2-during-autocon.patch

Review of attachment 9074142 [details] [diff] [review]:
-----------------------------------------------------------------

Setting this pref opens up other problems though. You may have to set your (gmail etc) account to use "less secure applications", and without that you won't really be able to log in + no good indications of why. 

Maybe when we have several options, we could have them listed, and let the user change them if required. 

And/or you could consider temporarily enabling the js during oauth.

Comment 3

[Magnus Melin [:mkmelin]]

Comment on attachment 9074142 [details] [diff] [review]
Add-pref-for-whether-we-accept-OAuth2-during-autocon.patch

Review of attachment 9074142 [details] [diff] [review]:
-----------------------------------------------------------------

(Please reflag for review if needed after comments answered.)

Comment 4

[anonym]

I'm wondering if we're exaggerating the dangers of enabling JavaScript in Thunderbird (i.e. javascript.enabled = true). What are the consequences, actually?

As far as I understand, JavaScript in email messages was completely removed in Thunderbird 3, but it still is enabled for messages from news feeds. Is there no way to disable the latter except javascript.enabled = false? Or does that even disable it?

The ideal would be if JavaScript was only enabled in the browser component, and nothing else. Is this achievable with current Thunderbird? Otherwise, any idea how hard it would be to implement a pref for disabling JavaScript in news feeds?

Comment 5

[Magnus Melin [:mkmelin]]

JavaScript is enabled by default yes, but like you wrote, only enabled in certain contexts.

Comment 6

[anonym]

How can I learn more about which contexts have JavaScript support?

Comment 7

[Magnus Melin [:mkmelin]]

It's basically those that are not mail messages. You can read https://searchfox.org/comm-central/source/mail/test/browser/content-policy/browser_jsContentPolicy.js

Comment 8

[u]

Unassigning myself and reassigning to anonym who seems to be working on this.

Comment 9

[Wayne Mery (:wsmwk)]

(In reply to Magnus Melin [:mkmelin] from comment #7)

It's basically those that are not mail messages. You can read https://searchfox.org/comm-central/source/mail/test/browser/content-policy/browser_jsContentPolicy.js

anonym, are you still wishing to work on this?

Comment 10

[Wayne Mery (:wsmwk)]

Note, this correlates to Bug 1174797 - handle OAuth not working with cookies/javascript disabled

Comment 11

[anonym]

I do not intend to work on this. I'm resolving this bug in favor of 1174797.