1668408 - DFPI breaks stackblitz.com

Status: VERIFIED FIXED

(Core :: Privacy: Anti-Tracking, defect, P2)

Description

[Emilio Cobos Álvarez (:emilio)]

STR:

• Go to https://stackblitz.com/edit/rxjs-yo2jz5?file=index.html

ER:

• A green square.

AR:

• Right tab doesn't load, there's a cross-origin error there.

Comment 1

[Dimi Lee [:dimi]]

This breakage can be fixed by changing cookiebehavior to 4, so this is only related to dFPI.

Comment 2

[Tim Huang[:timhuang]]

It looks like the right tab is put under a third-party iframe https://rxjs-yo2jz5.stackblitz.io and its storage is partitioned. And it needs storage access to show the content properly.

I think the proper solution is to ask the website to use the StorageAccessAPI.

Steve, do you know if we have contacted them about this issue? Thanks.

Comment 3

[Steven Englehardt [:englehardt]]

As far as I know we have not. We'll have to see if stpeter or webcompat folks have a contact.

Comment 4

[Emma Zühlcke [:emz]]

Filed an issue on their GitHub repo: https://github.com/stackblitz/core/issues/1374

Comment 7

[Thomas Wisniewski [:twisniewski]]

Attachment: Bug 1668408 - Work around site breakage on StackBlitz related to dFPI, by using SmartBlock shims to disable service workers; r?pbz,ksenia

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/f1b824815906
Work around site breakage on StackBlitz related to dFPI, by using SmartBlock shims to disable service workers; r=pbz,ksenia,webcompat-reviewers

Comment 9

[Cristian Tuns]

https://hg.mozilla.org/mozilla-central/rev/f1b824815906

Comment 10

[Simona Badau, Desktop QA]

Verified as fixed on the latest Nightly 95.0a1 and on Firefox 94 beta 1 (having the pref network.cookie.cookieBehavior set to 5) - the green square is properly displayed on stackblitz.com.
Tested on Windows 10 x64, Ubuntu 20.04 x64, and macOS Big Sur 11.6.

Comment 11

[Florens Verschelde :fvsch]

StackBlitz staffer here. Sorry if this is not the right venue, but is there a way for us to test in Firefox without this shim?

We have features that are breaking because of it (e.g. https://github.com/stackblitz/core/issues/1679 and a bunch of duplicate reports), because they rely on Service Workers, and we can't test fixes in Firefox because the shim seems to apply no matter what.

I tried setting a few about:config settings, but am not seeing a difference. I’m still getting a warning in the Console with

Service Workers are disabled by Firefox on this page to prevent breakage. See https://bugzilla.mozilla.org/show_bug.cgi?id=1668408 for details.

The about:config options I tried (in Firefox Nightly and stable) were:

• extensions.webcompat.enable_shims = false
• extensions.webcompat.perform_injections = false
• extensions.webcompat.perform_ua_overrides = false

Comment 12

[Emma Zühlcke [:emz]]

(In reply to Florens Verschelde :fvsch from comment #11)

StackBlitz staffer here. Sorry if this is not the right venue, but is there a way for us to test in Firefox without this shim?

We have features that are breaking because of it (e.g. https://github.com/stackblitz/core/issues/1679 and a bunch of duplicate reports), because they rely on Service Workers, and we can't test fixes in Firefox because the shim seems to apply no matter what.

I tried setting a few about:config settings, but am not seeing a difference. I’m still getting a warning in the Console with

Service Workers are disabled by Firefox on this page to prevent breakage. See https://bugzilla.mozilla.org/show_bug.cgi?id=1668408 for details.

The about:config options I tried (in Firefox Nightly and stable) were:

• extensions.webcompat.enable_shims = false
• extensions.webcompat.perform_injections = false
• extensions.webcompat.perform_ua_overrides = false

Navigate to about:compat and click "Disable" for StackBlitz. That should disable the shim for the current browser session.

Comment 13

[Florens Verschelde :fvsch]

Thanks a bunch :)

Comment 14

[Emma Zühlcke [:emz]]

Do we still need this shim, now that we support partitioned service workers? I've tested the original STR on Nightly with the shim disabled via about:compat and it seems to load just fine.

Comment 15

[Tim Huang[:timhuang]]

Yes, we have enabled the partitioned service workers since Fx 105. And I can confirm that it fixes this issue on stackblitz with the shim disabled. So, I think we can remove the shim.

Comment 16

[Emma Zühlcke [:emz]]

Awesome! I'll remove it in the bug 1795692.