1620179 - Cookies don't seem to be propagated with laxByDefault

Status: RESOLVED FIXED

(Core :: Networking: Cookies, defect, P2)

Description

[Andrei Petcu]

Attachment: bugzilla_bug.gif

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:75.0) Gecko/20100101 Firefox/75.0

Steps to reproduce:

go to https://alpha.uipath.com
log in with user password
[e-mail]
Test123$

Go to services.
Click on TestDefault.
(please see gif)

Actual results:

Got redirected back to alpha.uipath.com

Expected results:

Should have been redirected to https://alpha.uipath.com/testatksyoq/TestDefault

Comment 1

[Andrei Petcu]

Attachment: mozregression

Comment 2

[Andrei Petcu]

6:16.63 INFO: Last good revision: 862da1751d9fb10d1daa20940ffa722c888078b1 (2020-02-26)
6:16.63 INFO: First bad revision: 5e69563343eb5bb7b8dfaaacc1e634e57d4583a0 (2020-02-27)

Comment 3

[Emilio Cobos Álvarez (:emilio)]

Seems from the regression range the most likely culprit is bug 1616716?

Comment 4

[Emilio Cobos Álvarez (:emilio)]

Ah, or bug 1604212, actually more likely...

Comment 5

[Emilio Cobos Álvarez (:emilio)]

Can you confirm that toggling network.cookie.sameSite.laxByDefault back to false "fixes" it?

Comment 6

[Andrei Petcu]

I ran it again on Windows which seems to have more builds
2020-03-05T20:38:56: DEBUG : Found commit message:
Bug 1611710. Don't restrict the draw target to the visible area.

Sometimes the painting code will look at the clip which is derived
from the intial size of the surface and not draw if things if they
are outside of it. We want to draw the entire item so use dtRect
instead of visibleRect.

Differential Revision: https://phabricator.services.mozilla.com/D64277

2020-03-05T20:38:56: DEBUG : Did not find a branch, checking all integration branches
2020-03-05T20:38:56: INFO : The bisection is done.
2020-03-05T20:38:56: INFO : Stopped

Comment 7

[Andrei Petcu]

Yes, setting network.cookie.sameSite.laxByDefault to false fixes it

Comment 8

[j.j.]

Should this block meta bug 1618610 ?

Comment 9

[Andrei Petcu]

yes, it should!

Comment 10

[Andrei Petcu]

Ignore my last windows regression. I ran it again and I got a better result. I might have selected something wrong in that run.

2020-03-05T22:19:22: INFO : Narrowed integration regression window from [28a2fba7, 150b8347] (4 builds) to [a14a131c, 150b8347] (2 builds) (~1 steps left)
2020-03-05T22:19:22: DEBUG : Starting merge handling...
2020-03-05T22:19:22: DEBUG : Using url: https://hg.mozilla.org/integration/autoland/json-pushes?changeset=150b8347d28f8a05bddd6cd9ea4b7851490639a1&full=1
2020-03-05T22:19:23: DEBUG : Found commit message:
Bug 1604212 - Enable sameSite=lax by default, r=Ehsan,ahal

Differential Revision: https://phabricator.services.mozilla.com/D63081

2020-03-05T22:19:23: DEBUG : Did not find a branch, checking all integration branches
2020-03-05T22:19:23: INFO : The bisection is done.
2020-03-05T22:19:23: INFO : Stopped

Comment 11

[BugBot [:suhaib / :marco/ :calixte]]

Bugbug thinks this bug should belong to this component, but please revert this change in case of error.

Comment 12

[Andrea Marchesini [:baku]]

Cookie samesite=lax by default, is slowing become the standard. Chrome is rolling out this feature to 25% of users.
What I suggest is to contact uipath.com and ask them to add the attribute: 'sameSite=none'. Peter, do you know who can do it?

Comment 13

[Andrei Petcu]

I work at UiPath.
I forced same site lax on Chrome. I even waited 2 minutes before clicking the link. Are you sure this is not a Firefox issue and it's a web site issue?

Comment 14

[Andrea Marchesini [:baku]]

Attachment: Bug 1620179 - cookie sameSite=lax by default must have a 2 minute tolerance for unsafe HTTP methods, r?ehsan

Comment 15

[Andrei Petcu]

Should we add the SameSite=none or is this a Firefox bug?
Should I wait some more?

Comment 16

[Andrea Marchesini [:baku]]

This is a bug in firefox. I wrote a fix, it should be reviewed today and it should be available in nightly in 1 or 2 days max.

Comment 17

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/f50793e86245
cookie sameSite=lax by default must have a 2 minute tolerance for unsafe HTTP methods, r=ckerschb

Comment 18

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/mozilla-central/rev/f50793e86245

Comment 19

[Gary [:streetwolf52]]

FYI... fixed my issue with HBOGo.com. See Bug 1618336