1814544 - improve oauth2 logging for error cases

Status: RESOLVED FIXED

(Thunderbird :: Security, defect)

Description

[Magnus Melin [:mkmelin]]

We should make errors from oauth2 more findable.

Comment 1

[Magnus Melin [:mkmelin]]

NOTE: For the MS case in question, it's not actually and OAuth2 error. We get a success from OAuth2. It's just that auth we got can't be used for SMTP if SMTP AUTH is disabled on the tenant.
But then one does get
mailnews.smtp: Command failed: 535 Authentication unsuccessful, SmtpClientAuthentication is disabled for the Mailbox. Visit https://aka.ms/smtp_auth_disabled for more information. [ME3P282CA0085.AUSP282.PROD.OUTLOOK.COM 2023-02-02T03:03:41.538Z 08DB0468ADBF7A7C]; currentAction=_actionAUTH_XOAUTH2 SmtpClient.jsm:521:19
_onCommand resource:///modules/SmtpClient.jsm:521
_parse resource:///modules/SmtpClient.jsm:360
_onData resource:///modules/SmtpClient.jsm:418

Comment 2

[Magnus Melin [:mkmelin]]

Attachment: Bug 1814544 - improve oauth2 logging for error cases. r=leftmostcat

By raising it to warn, the logging will normally show in the console.

Comment 3

[Andrei Hajdukewycz [:sancus]]

Yeah, that one is an SMTP server error.

The initial suggestion was meant for the "error_description" that you get in the response JSON from the token request like in this screenshot: https://i.imgur.com/YqrqAbp.png

The only way to find errors in the JSON seems to be looking in the response data which is hard to explain to people.

Comment 4

[Magnus Melin [:mkmelin]]

Right, with the patch those would now be logged in the console in a warning.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/comm-central/rev/3c1be92d7eab
improve oauth2 logging for error cases. r=leftmostcat

Comment 6

[Magnus Melin [:mkmelin]]

Comment on attachment 9315520 [details]
Bug 1814544 - improve oauth2 logging for error cases. r=leftmostcat

[Approval Request Comment]
Safe improvements to OAuth2 logging

Comment 7

[Wayne Mery (:wsmwk)]

Comment on attachment 9315520 [details]
Bug 1814544 - improve oauth2 logging for error cases. r=leftmostcat

[Triage Comment]
No more betas this cycle.
But let's take this for esr102 - approved

Comment 8

[Rob Lemley [:rjl]]

Thunderbird 102.8.0:
https://hg.mozilla.org/releases/comm-esr102/rev/db0b1d516bca