1860965 - gmail google asks for oauth authentication. After providing email address "400 this is an error -- the server cannot process the request because it is malformed. Do not try again. That's all the information." (translated from Hungarian by me)

Status: RESOLVED INVALID

(Thunderbird :: Security, defect)

Description

[Imre Péntek]

Attachment: Képernyőkép ekkor: 2023-10-25 10-09-19.png

User Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/119.0

Steps to reproduce:

I was opening thunderbird as per usual

Actual results:

google asks for authentication in a browser window, but when I enter my email address it says

"400 this is an error -- the server cannot process the request because it is malformed. Do not try again. That's all the information." (translated from Hungarian by me)

Expected results:

thunderbird should have just worked as the day before.

since then I set up an app password (2fa was enabled by me months ago and it worked fine until now), but I cannot enter it anywhere.

Comment 1

[sfhowes]

The email address should be entered automatically in the OAuth window. When it isn't, it's usually because cookies aren't been accepted in TB Settings/Privacy & Security, which is necessary for OAuth to store a token in Saved Passwords. Change to Accept cookies, restart TB, enter the account (not app) password in the OAuth window to allow TB access.

Comment 2

[Imre Péntek]

Attachment: 01.png

Comment 3

[Imre Péntek]

if by oauth window you mean the window on 01.png it gets prepopulated as per screenshot. However cookies were disabled since months in my thunderbird for privacy reasons, re-enabling them solved the issue. Is there a way to force all thunderbird cookies to be session only? if so, would it break authantication (or anything)?

Comment 4

[sfhowes]

I don't think session cookies are possible, but you can do ... not accept cookies for all, but add an exception for accounts.google.com.

Comment 5

[Imre Péntek]

hello, and thank you for the support

first of all: I no longer consider this as a thunderbird bug

(for some reason the app specific password wasn't accepted for me, however my main password was accepted instead. I'm ok with that so assuming that it has no use I deleted my app sepcific password)

but you can not accept cookies for all, but add an exception for accounts.google.com
how do I do that?

Comment 6

[Imre Péntek]

(cannot edit)

but you can not accept cookies for all, but add an exception for accounts.google.com

how do I do that?

Comment 7

[sfhowes]

Settings/Privacy & Security, Web Content, Exceptions..., add accounts.google.com and Allow or Allow for Session.

Comment 8

[Imre Péntek]

ok thanks, I deleted all thunderbird cookies and it still works

Comment 9

[Wayne Mery (:wsmwk)]

Per comment 5 => invalid