1687370 - Cannot log into celesia-dm.wikidot.com when schemeful sameSite cookie is on

Status: RESOLVED INVALID

(Core :: Networking: Cookies, defect, P3)

Description

[Thomas Wisniewski [:twisniewski][PTO August 18-22]]

As reported in https://webcompat.com/issues/65659, one cannot log into celesia-dm.wikidot.com while in a private browsing window or with strict ETP on.

While trying to log in, I see these two requests are blocked, so it may be related to them:

http://stats.g.doubleclick.net/dc.js
http://edge.quantserve.com/quant.js

Comment 1

[Tim Huang[:timhuang]]

It turns out that this issue has nothing to do with ETP or TP. I can reproduce this issue with or without ETP.

I have found the root cause of it. This webcompact issue is caused by the cookie sameSite schemeful. Flipping network.cookie.sameSite.schemeful to false will resolve this issue.

Comment 2

[Kershaw Chang [:kershaw]]

FWIW, I can't reproduce this by enable sameSite schemful on chrome.

Comment 3

[Tom Schuster (MoCo)]

Can you still reproduce this? Did you create an account for this?

Comment 4

[Thomas Wisniewski [:twisniewski][PTO August 18-22]]

No, I didn't. But Tim was the one who did the diagnosis here, so I'll redirect to him for more info in case he does still have an account handy.

Comment 5

[Tim Huang[:timhuang]]

The issue is no longer reproducible for ETP strict mode. But it has a different issue in the private browsing window. The login process won't complete in PBM, but the page will still get logged in after a refresh.

And I have created an account to test it.

Comment 6

[Tom Schuster (MoCo)]

Thanks Tim! Can you just check if disabling network.cookie.sameSite.schemeful fixes the issue? Otherwise it's probably unrelated to schemeful cookies.

(You could also test network.cookie.sameSite.laxByDefault just to be save).

Comment 7

[Tim Huang[:timhuang]]

No, disabling those two prefs won't fix this issue. So, I think it's unrelated to schemeful cookies.

Comment 8

[edgul]

De-prioritizing to align with schemeful-samesite.

Comment 9

[Andrea Marchesini [:baku]]

I cannot reproduce this issue enabling just network.cookie.sameSite.schemeful.