1774567 - Cannot connect to Asana widget from Zendesk website with TCP enabled

Status: NEW

(Core :: Privacy: Anti-Tracking, defect, P3)

Description

[Cosmin Muntean [:cmuntean], Ecosystem QA]

Attachment: Cannot connect to Asana widget from Zendesk.mp4

[Notes]

• The issue is only reproducible when trying to connect to Asana widget from Zendesk. However, it is not reproducible if connecting to Zendesk widget from Asana.
• If ETP is turned off or is set back to Standard from "about:preferences" page, the issue is no longer reproducible. You can successfully connect to Asana widget from Zendesk.

[Affected versions]:

• Firefox Release 101.0.1 (Build ID: 20220608170832)
• Firefox Beta 102.0b8 (Build ID: 20220614185842)
• Nightly 103.0a1 (Build ID: 20220615214908)

[Affected Platforms]:

• Mac 12.4
• Windows 10 x64
• Linux Mint 20

[Prerequisites]:

• Have an Asana account created and logged in.
• Have a Zendesk account created and logged in.
• Have Asana widget installed to Zendesk. You can install it from here.
• Have the Strict option enabled from "about:preferences" page.
  OR
• Be enrolled in the ETP Phase II or Phase III rollout. You can force enroll by setting the "nimbus.debug" to true and navigate to about:studies?optin_slug=total-cookie-protection-beta-roll-out-phase-ii-switch-on-to-new-users&optin_branch=control. Note that a restart is required.

[Steps to reproduce]:

1. Open the Firefox browser with the profile from prerequisites.
2. In the Zendesk page, click the "Views" button from the left sidebar.
3. Select the Sample ticket (which is created by default).
4. Click the "Apps" button from the right part.
5. Click the "Connect to Asana" button displayed in the right part.
6. Observe the behavior.

[Expected result]:

• You are successfully connected to Asana and the ticket can be created.

[Actual result]:

• You are not connected to Asana and the "Connect to Asana" is re-displayed.

[Notes]:

• Attached is a screen recording of the issue.

Comment 1

[Paul Zühlcke [:pbz]]

Thanks! Do you have test accounts I could use for Asana and Zendesk to reproduce the issue locally?

Comment 2

[Cosmin Muntean [:cmuntean], Ecosystem QA]

Sure, Marius will share with you the test accounts on slack. Let me know if you need more information.

Comment 3

[Paul Zühlcke [:pbz]]

Thanks for sharing the test accounts. This is indeed TCP breakage. It is fixed by granting https://zendesk.integrations.asana.plus first-party storage access under https://*.zendesk.com. Short-term we can shim this, but we should reach out to Zendesk so they can integrate the Storage Access API if possible.

Comment 4

[Paul Zühlcke [:pbz]]

This is still broken with the allowlist entry disabled. It doesn't work in Safari either.
Since it's currently allowlisted I'm lowering the severity and I'm unassigning myself.

I've reached out to Asana to inform them about the breakage via their support email.