1578068 - SameSite=LaxByDefault breaks image upload on disqus

Status: RESOLVED WORKSFORME

(Core :: Privacy: Anti-Tracking, defect, P3)

Description

[tutudid]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:68.0) Gecko/20100101 Firefox/68.0

Steps to reproduce:

set privacy.firstparty.isolate.restrict_opener_access;false, login to disqus on a page, for example an article on presstv.com... login, upload image fails.

Comment 1

[Steven Englehardt [:englehardt]]

This is also broken under both Dynamic FPI and the Level 2 ETP cookie blocking list.

I can reproduce the breakage on https://batman-news.com/2020/04/10/quarantine-book-club-batman-ego/ (the site in Comment 0 no longer appears to use Disqus).

I'm able to log in successfully, but see the error message "You must be logged in to upload an image." if I try to upload an image.

The upload attempt makes a request to: https://uploads.services.disqus.com/api/3.0/media/create.json?api_key=FOO, which returns 400. What's interesting is that we do have a storage access permission for disqus.com since it uses a pop-up for login. IIRC we use origin for these checks, so this permission doesn't match the uploads.services.disqus.com request.

Comment 2

[Gary Chen [:xeonchen]]

(In reply to Steven Englehardt [:englehardt] from comment #1)

This is also broken under both Dynamic FPI and the Level 2 ETP cookie blocking list.

I can reproduce the breakage on https://batman-news.com/2020/04/10/quarantine-book-club-batman-ego/ (the site in Comment 0 no longer appears to use Disqus).

I'm able to log in successfully, but see the error message "You must be logged in to upload an image." if I try to upload an image.

The upload attempt makes a request to: https://uploads.services.disqus.com/api/3.0/media/create.json?api_key=FOO, which returns 400. What's interesting is that we do have a storage access permission for disqus.com since it uses a pop-up for login. IIRC we use origin for these checks, so this permission doesn't match the uploads.services.disqus.com request.

Yes, I can confirm that the requested permission type for uploading image is 3rdPartyStorage^https://uploads.services.disqus.com, but the granted permission type is 3rdPartyStorage^https://disqus.com.

Comment 3

[Steven Englehardt [:englehardt]]

Thanks Gary!

stpeter or mike: do we have contacts at Disqus that we could reach out to about this?

It seems like they may have two approaches to fixing this:

1. Short-term: move the upload functionality under the Disqus origin. This alone isn't ideal though, because the disqus.com storage access relies on our temporary compatibility heuristic.
2. Long-term: Use the Storage Access API.

Comment 4

[Mike Taylor [:miketaylr]]

Intro email sent.

Comment 5

[Johann Hofmann [:johannh]]

I can confirm this is still broken.

Comment 6

[Steven Englehardt [:englehardt]]

I've confirmed that this is also broken in Safari and in Chrome incognito.

Comment 7

[Peter Saint-Andre [:stpeter]]

I've reached out to someone at Disqus through a mutual connection and will report back if this attempt is successful.

Comment 8

[Tim Huang[:timhuang]]

I can no longer reproduce this issue by using the link https://batman-news.com/2020/04/10/quarantine-book-club-batman-ego/

Johann, would you be able to confirm? Thanks.

Comment 9

[Johann Hofmann [:johannh]]

This seems to have been fixed on Disqus side, I can no longer reproduce it either. This is good!

Comment 10

[Hani Yacoub, Desktop QA]

Attachment: Screenshot 2021-09-30 at 12.11.47.png

I managed to reproduce this issue on the Firefox nightly 94.0a1 (2021-09-29), "You must be logged in to upload an image." message received even after being logged in.
Please note that I managed to reproduce this issue on Chrome also.

Comment 11

[Johann Hofmann [:johannh]]

Can you try to flip network.cookie.sameSite.laxByDefault to false and try again in Nightly? This would explain why it breaks in Chrome as well.

Thanks!

Comment 12

[Hani Yacoub, Desktop QA]

Verified as fixed on Firefox Nightly 95.0a1 with both prefs "network.cookie.sameSite.laxByDefault" and "privacy.firstparty.isolate.restrict_opener_access" set to false.
Verified as fixed on Firefox Beta 94.0b2 and on Firefox 93.0 with cookiebehavior set to 5 and both prefs from above set to false.
All verifications were made on Windows 10 x64, macOS 10.15 and on Ubuntu 20.04.
Thanks.

Comment 13

[Johann Hofmann [:johannh]]

Thanks Hani! Reopening this as breakage for SameSite=Lax

Comment 14

[Daniel Veditz [:dveditz]]

Should have opened a new bug for the SameSite breakage -- that's a completely different mechanism and would require different fixes (by the site and/or Mozilla) than one caused by dFPI/ETP.

Comment 15

[Daniel Veditz [:dveditz]]

I can upload an image just fine on blogs using Disqus. I tried the Batman News site linked here and jqueryscript.net

Given this was broken on Chrome as well, and our laxByDefault setting is supposed to match their behavior, it's quite likely Discus fixed it. When I check my disqus cookies now almost all of them are using an explicit SameSite=None. That's the explicit opt-out setting by sites to get the behavior before laxByDefault was turned on.

Comment 16

[Dianna Smith [:diannaS]]

marking as disabled for fx96 since we set sameSite.laxByDefault and sameSite.noneRequiresSecure to false via a pref flip