[Describe the breakage component] on my.connect.aws with ETP - Standard Enabled
Categories
(Core :: Privacy: Anti-Tracking, defect)
Tracking
()
People
(Reporter: me, Unassigned)
Details
Environment:
Browser / Version: 112.0
Operating System: Arch Linux
Prerequisites:
Unfortunately you cannot reproduce this issue without creating an AWS account & setting up AWS Connect
Steps to Reproduce:
This domain is for company-internal customer service tools. Typical use case for this site is to embed a subdomain of my.connect.aws into your app as an iframe, and in that case you would want that iframe to use the global cookie jar so that the iframe is already logged in.
This site and it's subdomains are never customer-facing.
Expected Behavior:
Actual Behavior:
Notes:
|
||
Comment 1•3 years ago
|
||
This bug is not actionable in its current form. Please fill in all the fields provided by the template including a description of the problem and ideally include a minimal PoC for us to reproduce. Closing this bug as invalid.
Sorry, hopefully this clears things up. I don't know what "Describe the breakage component" is.
Environment:
Browser / Version: 112.0
Operating System: Arch Linux
Prerequisites:
Unfortunately you cannot reproduce this issue without creating an AWS account & setting up an AWS Connect instance
Steps to Reproduce:
Create a webpage with the following code from https://github.com/amazon-connect/amazon-connect-streams/blob/master/Documentation.md#connectcoreinitccp, replacing my-instance-domain with your AWS connect instance and the region with the correct region.
<!DOCTYPE html>
<html>
<head>
<meta charset="UTF-8">
<script src="https://cdn.jsdelivr.net/gh/amazon-connect/amazon-connect-streams/release/connect-streams-min.js"></script>
</head>
<!-- Add the call to init() as an onload so it will only run once the page is loaded -->
<body onload="init()">
<div id="container-div" style="width: 400px; height: 800px;"></div>
<script type="text/javascript">
var containerDiv = document.getElementById("container-div");
var instanceURL = "https://my-instance-domain.awsapps.com/connect/ccp-v2/";
// initialize the streams api
function init() {
// initialize the ccp
connect.core.initCCP(containerDiv, {
ccpUrl: instanceURL, // REQUIRED
loginPopup: true, // optional, defaults to `true`
loginPopupAutoClose: true, // optional, defaults to `false`
loginOptions: { // optional, if provided opens login in new window
autoClose: true, // optional, defaults to `false`
height: 600, // optional, defaults to 578
width: 400, // optional, defaults to 433
top: 0, // optional, defaults to 0
left: 0 // optional, defaults to 0
},
region: "eu-central-1", // REQUIRED for `CHAT`, optional otherwise
softphone: { // optional, defaults below apply if not provided
allowFramedSoftphone: true, // optional, defaults to false
disableRingtone: false, // optional, defaults to false
ringtoneUrl: "./ringtone.mp3" // optional, defaults to CCP’s default ringtone if a falsy value is set
},
pageOptions: { //optional
enableAudioDeviceSettings: false, //optional, defaults to 'false'
enablePhoneTypeSettings: true //optional, defaults to 'true'
},
shouldAddNamespaceToLogs: false, //optional, defaults to 'false'
ccpAckTimeout: 5000, //optional, defaults to 3000 (ms)
ccpSynTimeout: 3000, //optional, defaults to 1000 (ms)
ccpLoadTimeout: 10000 //optional, defaults to 5000 (ms)
});
}
</script>
</body>
</html>
Launch a HTTPS server to serve the page above.
In your AWS Connect console, set that server's domain (which may be localhost, or some other domain) as an allowed origin.
In a new tab, launch the AWS Connect agent console using either the emergency access button or the ordinary login method.
Expected Behavior:
Reload the page you've created above. Observe that you're logged in.
Actual Behavior:
Reload the page you've created above. Observe that you are not logged in, but instead see a 'the loading of "..." in a frame is denied by "X-Frame-Options" directive set to SAMEORIGIN.' error. This is because the page you've created above uses a separate cookie jar due to "Total Cookie Protection", so AWS Connect is trying to redirect you to the login page.
If Enhanced Tracking Protection is turned off, this works as expected.
Notes:
This domain is for company-internal customer service tools. Typical use case for this site is to embed a subdomain of my.connect.aws into your app as an iframe, and in that case you would want that iframe to use the global cookie jar so that the iframe is already logged in.
This site and it's subdomains are never customer-facing.
See also https://github.com/amazon-connect/amazon-connect-streams/issues/661
|
|
||
Updated•3 years ago
|
|
|
||
Comment 3•3 years ago
|
||
As noted in the issue you linked, as a workaround you can disable ETP for the given site via the protections panel (shield icon). You may also do this on a larger scale via enterprise policies.
If the above options don't work for you, you can also call the Storage Access API from within the iframe to request access to first-party cookies (storage is always partitioned and cannot be unpartitioned). Though if you're only integrating a library, they might have to do that on their end.
I'm not familiar with the details of Amazon Connect, but It may also be possible to use CNAMEs to use the same site for the top level and the iframe. Though note that this has security implications.
Generally browsers are slowly phasing out 3rd-party cookies, so relying on cross-site 3rd-party cookies will eventually even stop working in Chrome as they're phasing out 3rd-party cookies (see timeline here).
|
||
Comment 4•2 years ago
|
||
A needinfo is requested from the reporter, however, the reporter is inactive on Bugzilla. Given that the bug is still UNCONFIRMED, closing the bug as incomplete.
For more information, please visit BugBot documentation.
Description
•