1569750 - Monitor isn't showing data despite being logged in with an active monitor account

Status: RESOLVED FIXED

(Firefox :: Protections UI, defect, P1)

Description

[Kristian Klausen]

Attachment: aboutsupport.txt

Hi

I just tried clicking "Turn on monitor" on the about:protections page, and it works but "Turn on monitor" is still shown.

So I did a bit of debugging. "User is not subscribed to Monitor" is shown every time about:protections is reloaded and a request is made to https://monitor.firefox.com/user/breach-stats which return {"errorMessage":"Cannot find FXA for that OAuth token."}, so something is wrong.

I have a suspicion that "Cookie AutoDelete" and/or the "Lockwise" addon could be the culprit. I have removed the Lockwise addon today as it is builtin now, but maybe it did mess something up? I did try starting Firefox in safe-mode, but it didn't change anything.

Nightly 70.0a1 (20190729095501)

• Kristian Klausen

Comment 1

[Johann Hofmann [:johannh]]

Thanks for filing this bug, I've seen this behavior in recent days, too. I'm logged into my Sync account and I previously used to see my Monitor stats on about:protections but now it's just showing the generic "Turn on Monitor" card.

Micah, Ryan, can you look into this, please? :)

Let me know if you need my help reproducing/debugging.

Thanks!

Comment 2

[Ryan Kelly [:rfkelly]]

I noticed this today as well. Firefox has a cached OAuth token that has expired, but the version of Monitor that is currently in production rejects it with a 404 error rather than a 400 or 401, so the client never ends up learning that the token is invalid. Signing out of Sync and signing back in causes it to start working again.

I expect things will all start working correctly as soon as https://github.com/mozilla/blurts-server/pull/1138 hits the production servers, with no user action required. :groovecoder, do we have an ETA on such deployment?

If necessary, we could work around this on the client side in the meantime by special-casing the "Cannot find FXA for that OAuth token" error message and treating it like a 401. (In fact :mtigley's original patch did this, but I advised against it for future-proofing reasons; I wouldn't be opposed to it for backwards-compatibility reasons though...).

Comment 3

[Luke Crouch [:groovecoder]]

This should be fixed now.