1888019 - Use a different client ID, scope and keys for Sync in Thunderbird

Status: RESOLVED FIXED

(Firefox :: Firefox Accounts, enhancement)

Description

[Geoff Lankow (:darktrojan)]

To avoid accidentally or maliciously accessing Firefox Sync data from Thunderbird, we're going to use a different client ID and scope. I think it should be sufficient to choose which ones to use based on AppConstants.MOZ_APP_NAME. (Seems too easy?)

This depends on the OAuth flow being ready to use.

The scopes will need to be created on the FxA servers, I'm testing using the changes here https://github.com/mozilla/fxa/compare/main...darktrojan:fxa:thunderbird-scopes.

Comment 1

[Geoff Lankow (:darktrojan)]

Attachment: Bug 1888019 - Use a different client ID, scope and keys for Sync in Thunderbird. r=markh,teshaq

Comment 2

[Geoff Lankow (:darktrojan)]

Attachment: Bug 1888019 - Add preferences needed to enable FxA tests. r=#thunderbird-reviewers

These preferences need a default value or otherwise the tests I'm trying to enable use a different default value and fail.

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/comm-central/rev/a2d3e88c2ecf
Add preferences needed to enable FxA tests. r=mkmelin

Comment 4

[Ben Bangert [:benbangert]]

Noting here that Thunderbird ideally uses a different client id for each application/service. e.g. there should be a different client ID for each of these:

• Thunderbird website
• Thunderbird on Windows
• Thunderbird on MacOS
• Thunderbird on Linux
• Thunderbird for iOS
• Thunderbird for Android
  etc.

Hopefully this is already how these are being used. :)

Comment 5

[Geoff Lankow (:darktrojan)]

• Thunderbird website

I'm not sure that our website is using FxA for anything. The add-ons site does, and I assume that has a client ID of its own. It's really not my department.

• Thunderbird on Windows
• Thunderbird on MacOS
• Thunderbird on Linux

Thunderbird on desktop will have a single ID across the platforms, just like Firefox does.

• Thunderbird for iOS
• Thunderbird for Android

These will get IDs of their own when they get that far.

Comment 6

[Geoff Lankow (:darktrojan)]

What do I have to do to get this client ID and scope onto the staging server? File a bug? Where?

(Related: I created https://github.com/mozilla/fxa/pull/16706 to add them to the dev config so that I'm not the only one who can test/develop against the server locally.)

Comment 7

[Mark Hammond [:markh] [:mhammond]]

Will, can you help with Geoff's question above?

Comment 8

[Wil Clouser [:clouserw]]

What do I have to do to get this client ID and scope onto the staging server? File a bug? Where?

File an issue in the SVCSE project in jira

Comment 9

[Geoff Lankow (:darktrojan)]

Sorry, I don't have access to your Jira. Is there another way?

Comment 10

[Wil Clouser [:clouserw]]

It's not my process. I'll needinfo Tom.

Comment 11

[Geoff Lankow (:darktrojan)]

Tom, ping?

Comment 12

[Tom Healy (Slack me, I don't monitor here)]

Hi Geoff. I'll ping my team about it and let you know. As an fyi for the future: I mention in my bugzilla profile but I do not actively monitor Bugzilla so if you need my attention on something, hitting me up in slack is the fastest way.

Comment 13

[Tom Healy (Slack me, I don't monitor here)]

I've created a jira ticket in my teams queue to be prioritized. We will try to get it completed within a week or two given our current workload.

Comment 14

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/1a2ecf71fee5
Use a different client ID, scope and keys for Sync in Thunderbird. r=teshaq,sync-reviewers

Comment 15

[Geoff Lankow (:darktrojan)]

Attachment: Bug 1888019 follow-up - Update the Thunderbird client ID in a test. r=markh

I forgot to update this test, so it'll fail on comm-central.

Comment 16

[Iulian Moraru]

https://hg.mozilla.org/mozilla-central/rev/1a2ecf71fee5

Comment 17

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/029bfd81274d
follow-up - Update the Thunderbird client ID in a test. r=markh

Comment 18

[Cristian Tuns]

https://hg.mozilla.org/mozilla-central/rev/029bfd81274d

Comment 19

[Geoff Lankow (:darktrojan)]

Comment on attachment 9393408 [details]
Bug 1888019 - Use a different client ID, scope and keys for Sync in Thunderbird. r=markh,teshaq

Beta/Release Uplift Approval Request

• User impact if declined: This doesn't change anything for Firefox, but we want to be able to use it in Thunderbird ESR 128 once the server-side changes are ready.
• Is this code covered by automated tests?: Yes
• Has the fix been verified in Nightly?: Yes
• Needs manual test from QE?: No
• If yes, steps to reproduce:
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): Almost all of this code (OAuth flow for Mozilla Accounts) is preffed off.
• String changes made/needed:
• Is Android affected?: No

Comment 20

[Geoff Lankow (:darktrojan)]

Comment on attachment 9408340 [details]
Bug 1888019 follow-up - Update the Thunderbird client ID in a test. r=markh

Beta/Release Uplift Approval Request

• User impact if declined: This is fix for a test. The client ID of Thunderbird was changed (in the other patch) before landing and I forgot to update the corresponding test.
• Is this code covered by automated tests?: Yes
• Has the fix been verified in Nightly?: Yes
• Needs manual test from QE?: No
• If yes, steps to reproduce:
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky):
• String changes made/needed:
• Is Android affected?: No

Comment 21

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9393408 [details]
Bug 1888019 - Use a different client ID, scope and keys for Sync in Thunderbird. r=markh,teshaq

Approved for 128.0b7.

Comment 22

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-beta/rev/cacaf4eade3f
https://hg.mozilla.org/releases/mozilla-beta/rev/98a0f560e7d1