1785281 - Google Login broken on custom rally domain owing to total cookie protection

Status: RESOLVED FIXED

(Core :: Privacy: Anti-Tracking, defect, P1)

Description

[akaila]

Repro steps:

• In nightly 105 build visit https://moz-fx-data-rally-w-prod-dfa4.firebaseapp.com and try to login with Google
• The site redirects to Google login and redirects back trying to set cookies on auth domain: members.rally.allizom.org.
• Console prints the warning: Some cookies are misusing the “SameSite“ attribute, so it won’t work as expected

Proposed fix: Extend shim to custom allizom domain.

Comment 1

[Paul Zühlcke [:pbz]]

Attachment: Bug 1785281 - Extend Firebase sign-in shim to handle custom domain allizom.org. r=twisniewski!

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/ecef8322bf48
Extend Firebase sign-in shim to handle custom domain allizom.org. r=twisniewski,webcompat-reviewers

Comment 3

[Marian-Vasile Laza]

https://hg.mozilla.org/mozilla-central/rev/ecef8322bf48

Comment 4

[Paul Zühlcke [:pbz]]

Could you test again on an up-to-date Nightly and a fresh profile to see if the issue has been fixed? Thank you!

Comment 5

[akaila]

Tried out with a new profile on 105.0a1 and noticed that https://members.rally.allizom.org worked but https://moz-fx-data-rally-w-prod-dfa4.firebaseapp.com did not. Also https://stage.rally-web.nonprod.dataops.mozgcp.net worked for the same web app.

Comment 6

[Paul Zühlcke [:pbz]]

Looks like we didn't cover the domain members.rally.mozilla.org which https://moz-fx-data-rally-w-prod-dfa4.firebaseapp.com uses for the redirect sign-in flow. I'm creating a patch.

Comment 7

[Paul Zühlcke [:pbz]]

Attachment: Bug 1785281 - Add members.rally.mozilla.org redirect to Firebase sign-in shim. r=twisniewski!

Comment 8

[Phabricator Automation]

Comment on attachment 9290677 [details]
Bug 1785281 - Add members.rally.mozilla.org redirect to Firebase sign-in shim. r=twisniewski!

Revision D155092 was moved to bug 1786305. Setting attachment 9290677 [details] to obsolete.

Comment 9

[Paul Zühlcke [:pbz]]

Landing the patch for the other domain in Bug 1786305 because that's targetting 106 now. We can do an uplift later.

Comment 10

[Paul Zühlcke [:pbz]]

Could you try again with the latest version of Nightly now that Bug 1786305 landed? Thank you! If that fixes it I'll uplift the change to 105.

Comment 11

[akaila]

Tested and all domains work in 106. We can mark this as fixed! Thanks