1818497 - Unable to login on instagram.com

Status: VERIFIED FIXED

(Core :: Privacy: Anti-Tracking, defect, P3)

Description

[Calin Tanase]

Attachment: instagram FF focus.png

Environment:
Operating system: OnePlus 6 A6000 (Android 11) / Google Pixel 5 (Android 13)
Firefox version: Firefox Focus 110.0-20230213213738 / Firefox Focus Nightly 112.0a1-20230222214030

Steps to reproduce:

1. Go to https://www.instagram.com
2. Log into your account.
3. Observe the behaviour.

Expected Behaviour:
The account login is possible.

Actual Behaviour:
The login is not possible, error displayed "CSRF token missing or incorrect".

Notes:

1. Screenshot provided
2. Reproducible on both Firefox Focus and Firefox Focus Nightly
3. Not reproducible on Firefox Release and Firefox Nightly in private (regardless of the ETP status)

Comment 1

[Mira Lobontiu (Android QA)]

Attachment: instagram issue.png

I was able to reproduce this issue on the latest Focus Nightly build 112.0a1 from 2/23 with Oppo Reno 6 (Android 12).

I had a hunch it is somewhat related to some Cookie banner preference from about:config (because of this issue: https://github.com/mozilla/cookie-banner-rules-list/issues/173).
So, when setting in Focus, in about:config, the 'cookiebanners.service.detectOnly' pref from false to true, I was able to log in to instagram without issues. When I set it back to false, I wasn't able to log in anymore.

I'm not 100% sure that this is the main cause, but maybe it helps.
Thank you!

Comment 2

[Emma Zühlcke [:emz]]

This is https://github.com/mozilla/cookie-banner-rules-list/issues/173
I've just merged a change into RemoteSettings that should disable the offending rule on mobile. Could you please help verifying that this fixes the issue? It may take a while for the RemoteSettings changes to be distributed via the CDN.
On a fresh profile after the change you should see the cookie banner again and interacting with it and logging into your account after that should work.

Comment 3

[Mira Lobontiu (Android QA)]

The issue is still reproducible on the latest Focus Nightly 112.0a1 from 2/24 on the same Oppo Reno 6 (Android 12) device.
I'll test again in the following days.

Comment 4

[Emma Zühlcke [:emz]]

I don't have a test account at hand (my test accounts keep getting blocked), but I was able to verify that my Google Pixel 5 on Fenix does no longer get served the rule for instagram.com and thus should not apply it. It may take a while for the change to appear on your phone. Thanks for testing!

Comment 5

[Mira Lobontiu (Android QA)]

I was able to log in to instagram.com on the latest Focus Nightly 112.0a1 from 2/27 with the following devices:

• Google Pixel 6 (Android 13),
• Oppo Reno 6 (Android 12), and
• Lenovo tablet M10 (Android 10).

I'll close this bug as verified, fixed.

Comment 6

[Joe M [:jmahon]]

Moving to Privacy: Anti-tracking in case that's helpful for future validations.

Comment 7

[Chris Peterson [:cpeterson]]

I verified that I can successfully log into Instagram using Focus 110 and Focus Beta 111.