1662981 - Sign up is not performed on playscavengers.com with ETP - Strict enabled

Status: RESOLVED WORKSFORME

(Core :: Privacy: Anti-Tracking, defect, P3)

Description

[Oana Arbuzov [:oanaarbuzov]]

Attachment: StrictVsStandard.png

Environment:
Browser / Version: Firefox Nightly 200902 (🦎 82.0a1-20200831091558)
Operating System: Huawei P20 Lite (Android 8.0.0) - 1080 x 2280 pixels, 19:9 ratio (~432 ppi density), Samsung Galaxy S6 Edge (Android 7.0) - 1440 x 2560 pixels (~577 ppi pixel density)

Steps to reproduce:

1. Navigate to https://playscavengers.com/news/scavengers-playtest-faq
2. Tap "Browse" menu (top right side button).
3. Tap "Sign up for playtest" button.
4. Type in a valid email address and tap "Sign up" button.
5. Observe behavior.

Expected Behavior:
Sign up is performed, confirmation link is sent via email.

Actual Behavior:
Nothing happens, sign up is not performed.

Notes:

1. Screenshot attached.
2. The issue is not reproducible with ETP - Standard enabled.

Comment 1

[Oana Arbuzov [:oanaarbuzov]]

The issue is still reproducible, with ETP - Strict sign up is not performed.

Tested with:
Browser / Version: Firefox Nightly 210222 (🦎 87.0a1-20210218092411)
Operating System: Samsung Galaxy S8 (Android 9) - 1440 x 2960 pixels, 18.5:9 ratio (~570 ppi density)

Comment 2

[Thomas Wisniewski [:twisniewski]]

When I click on the "Sign up" button, I see this in the console:

The resource at “https://midwinter.us12.list-manage.com/subscribe/post-json?u=1d8c30c9b5d80b346f1dac139&id=ac36cd770d&EMAIL=a%40a.com&CLIENTID=undefined&LANGUAGE=en&c=__jp1” was blocked because content blocking is enabled.

So we could possibly just allow that request if the user has just submitted a form with an email attribute.

Comment 3

[Thomas Wisniewski [:twisniewski]]

Unfortunately, it seems that there is no real script we can "shim" to do this, as the site just makes the request in the end without loading any related scripts first. As such I don't see any easy way for shims to do this as a general fix; it would have to be specific to this site (as in, we'd have to figure it out on a case by case basis). It might be better to come up with a way to just allow specific requests through if a form is submitted during a user-interaction.

Comment 4

[Thomas Wisniewski [:twisniewski]]

"Sign up for playtest" is gone, so this doesn't seem to be a problem anymore.