1574209 - Application using Custom URI gets this error "Malformed callback URL." after installing 68.0.2. It seems to be related to this recent bug fix: 1567614

Status: RESOLVED DUPLICATE of bug 1573051

(External Software Affecting Firefox :: Other, defect)

Description

[cstaff16]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:68.0) Gecko/20100101 Firefox/68.0

Steps to reproduce:

The change made for the bugfix (1567614) seems to have caused an issue with our application. We use IdentityServer for our login. We use a .net desktop application to login via the browser and with the latest Firefox update, the IdentityModel.Client assembly returns this error:
"Malformed callback URL."

It worked prior to 68.0.2 and currently works fine with Chrome, Edge, and IE11.
Here is a stacktrace from Visual Studio:
at IdentityModel.Client.AuthorizeResponse.ParseRaw()
at IdentityModel.Client.AuthorizeResponse..ctor(String raw)
at IdentityModel.OidcClient.OidcClient.<ProcessResponseAsync>d__13.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at IdentityModel.OidcClient.OidcClient.<LoginAsync>d__9.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at System.Runtime.CompilerServices.TaskAwaiter`1.GetResult()
at Daikin.DaikinTools.Authentication.AuthenticationService.<Login>d__66.MoveNext()

Actual results:

Our users get this error logging in to our application:
"Malformed callback URL."

Expected results:

The login via the browser should properly get redirected back to our application via the Custom URI.

Comment 1

[(No longer employed by Mozilla) Aaron Klotz]

Can you tell me a bit about the structure of your custom URI? Does it include a fragment (# component) by any chance?

Comment 2

[(No longer employed by Mozilla) Aaron Klotz]

Also, if you could log the URI that your application is receiving when it is launched by Firefox, and compare it to the URI that you clicked on, do you see any differences between the two?

Comment 3

[cstaff16]

We login using this url: https://sso.daikinapplied.com/account/login?returnUrl=%2Fconnect%2Fauthorize%2Fcallback%3Fresponse_type%3Dcode%2520id_token%26nonce%3D33e446eb385e0b1abe26a6bf1cf7bd01%26state%3D4df8a95e3fe8862ebebf0445ebd6498a%26code_challenge%3DoTr9EY49Ufx0B3f3geBcaCAMvVz58ZuqeP69zgBCfUE%26code_challenge_method%3DS256%26client_id%3Ddaikintoolsprd%26scope%3Dopenid%2520email%2520profile%2520offline_access%2520shortloginid%2520role%2520legacyrole%2520repofficeid%2520daikintoolssvcapiprd%2520daikindcwprd%2520daikinparprd%2520daikinaddrvalprd%2520daikinpipelineprd%2520daikinstockprd%2520cadsdeapiprd%2520opsrecvapiprd%26redirect_uri%3Ddaikinsso%253A

Here is a sample response captured a few days ago from a login via Firefox 68.0.1
daikinsso:#code=ae8589127580d79714d2e5bd2e96d8fb71835a35eb90ba3e7190d3ccab4aae82&id_token=eyJhbGciOiJSUzI1NiIsImtpZCI6IjU2QzAxM0VCODVEN0MwODA1QzA2NkVERDg2RUU1MjM5MUVCNDZCQTAiLCJ0eXAiOiJKV1QiLCJ4NXQiOiJWc0FUNjRYWHdJQmNCbTdkaHU1U09SNjBhNkEifQ.eyJuYmYiOjE1NjU2NDc3MjAsImV4cCI6MTU2NTY0ODAyMCwiaXNzIjoiaHR0cHM6Ly9zc28uZGFpa2luYXBwbGllZC5jb20iLCJhdWQiOiJkYWlraW50b29sc3ByZCIsIm5vbmNlIjoiNDAyZjcxZGQ1ZDZhZWViOGU1N2RhMGI5YjZmMTQzOGUiLCJpYXQiOjE1NjU2NDc3MjAsImNfaGFzaCI6IjZPTml3OVdMd3h5NXpRMGZEVjRfTnciLCJzaWQiOiIzZDUyZjNlZTA5MTRkNzNmODZiNTk2ODQxZTI5YzY1YyIsInN1YiI6Ijk2NTBmYmQ5LTM0NTYtNGRhNi1hNzUyLTk4MDM2OGI5OGM5NSIsImF1dGhfdGltZSI6MTU2NTY0Mzg0MywiaWRwIjoibG9jYWwiLCJhbXIiOlsicHdkIl19.lnVVBugPa96vFMKncleiiBBWQjsOdUR9WuwbEbrZgYqOr1X_0QGw4Il17uMYKVSw8IcDoN5qn6FWP1mgYm8lmqGMw9cuOeB3eL7n8DnIwFWDReLf2Mryu15UdzN3dksubM6nuaZN6jKlobAF1435_zMgTvb6bn6zxb5LZG5msiGvTbEkN6as5gKqTpj74mHpN0FH2NAyhHtEwpNbPCEATd_rjaHAjgt3NKjAnJgY2N1Fbmv7InH-tfywvM_ui5XOoiFoDssOVAiP9gF1rZfJJM9jRlOBZ3e3ji7_VslWNtrjepAua9qQzg49xm2Zwd6nAdE7tZBjH7w1-Zn_fo6phA&scope=openid%20email%20profile%20shortloginid%20role%20legacyrole%20repofficeid%20daikintoolssvcapiprd%20daikindcwprd%20daikinparprd%20daikinaddrvalprd%20daikinpipelineprd%20daikinstockprd%20cadsdeapiprd%20opsrecvapiprd%20offline_access&state=fdb7f72c6e041ea4a04498cb20c6d762&session_state=Q7CMzX4Q5Rjprf51fv4zEBlGYlg91VwQPi1amihY_AQ.eb6c24d957513b7bf160ace416342b17

Comment 4

[(No longer employed by Mozilla) Aaron Klotz]

I think this will be resolved by bug 1573051, but I won't dupe it over until we can verify that.

Comment 5

[cstaff16]

If 1573051 does fix the issue, when is expected to be released?

Comment 6

[(No longer employed by Mozilla) Aaron Klotz]

(In reply to cstaff16 from comment #5)

If 1573051 does fix the issue, when is expected to be released?

It will be in tomorrow's Nightly and we'll backport it into 68ESR and 69.

Comment 7

[(No longer employed by Mozilla) Aaron Klotz]

Can you try today's Nightly build and let us know if your problem is fixed?

Comment 8

[cstaff16]

The nightly build appears to have fixed our issue, I was able to login successfully to our application.
Thanks.

Comment 9

[(No longer employed by Mozilla) Aaron Klotz]

Great, thanks for your prompt reply! I am going to dupe this over to bug 1573051.