1954533 - copaair.com - Unable to create an account, stuck loading after accepting Terms and Conditions

Status: REOPENED

(Web Compatibility :: Site Reports, defect, P1)

Description

[Calin Tanase]

Attachment: FF vs Chrome.png

Environment:
Operating system: Windows 11/10
Firefox version: Firefox 136.0.1 (release)/138

Preconditions:

• Clean profile

Steps to reproduce:

1. Navigate to: https://www.copaair.com/en-gs/enrollment/
2. Fill in the required fields.
3. Click on "Create an account".
4. Accept the Terms and Conditions.

Expected Behavior:
Account gets created, welcome window shown.

Actual Behavior:
Stuck loading on the Terms and Conditions window.

Notes:

• Reproducible on the latest Firefox Release and Nightly
• Reproducible regardless of the ETP setting
• Works as expected using Chrome

---

Created from webcompat-user-report:21ba2197-0fc7-48f4-99dc-c120d570e8f3

Comment 1

[BugBot [:suhaib / :marco]]

Since nightly and release are affected, beta will likely be affected too.
For more information, please visit BugBot documentation.

Comment 2

[Sky Schubert [:skyschub]]

On clicking the button, I see a

Uncaught TypeError: can't access property "innerText", document.querySelector(...) is null

but no idea what it's looking for.

Comment 3

[Sean Feng [:sefeng211]]

Here's a profile for that infinite stuck https://share.firefox.dev/4bGK9jx with nsHttp:5 logging enabled

It looks like we never finish the https://apicm.copaair.com/loyalty/createProfile request.

I wonder if necko folks can take a look about this first.

Comment 4

[Valentin Gosu [:valentin]]

there's definitely something networking related happening.
I see the following in wireshark:

TLSv1.3 Record Layer: Alert (Level: Warning, Description: Close Notify)
    Opaque Type: Application Data (23)
    Version: TLS 1.2 (0x0303)
    Length: 19
    [Content Type: Alert (21)]
    Alert Message
        Level: Warning (1)
        Description: Close Notify (0)

Unclear if the server is broken by itself, or if we are doing something wrong.

Comment 5

[Randell Jesup [:jesup] (needinfo me)]

Kershaw - can you take a look since Valentin is on PTO for 2 weeks? Thanks

Comment 6

[Valentin Gosu [:valentin]]

The bug seems to reproduce only in Firefox, when HTTP/2 is enabled
It works in Chrome and Safari.
Turning off HTTP/2 seems to make it work.
The GoAway i was seeing earlier was on a backup connection, and TLS Alert, so not really relevant, but the request does seem to stall.
I'm currently looking at what exactly is different between the Chrome request and Firefox request, but this does seem to be a difference.
I also did a mozregression back to Fx 90, and could still reproduce the bug. Either this is a corner case in our implementation, or an issue with the server, but given that it only happens in Firefox, I'd say it's probably Firefox's fault.

Comment 7

[Valentin Gosu [:valentin]]

This is actually a site problem.
Opening https://apicm.copaair.com/loyalty/createProfile in a new tab times out, while opening https://apicm.copaair.com/loyalty/ returns immediately.
The User-Agent header didn't seem to impact this.

I copied the request as curl, and it also timed out when loaded via curl.
Removing arguments one by one, I narrowed it down to curl 'https://apicm.copaair.com/loyalty/createProfile' -H 'TE: trailers' -v
It seems it's the TE: trailers header is the one causing the issue.

Comment 8

[Valentin Gosu [:valentin]]

I sent an email to [e-mail] notifying them of the issue.

Dennis, I think we can theoretically also ship an intervention where we clear the header prior to sending the request?
Is this important enough to do that?

Comment 9

[Sky Schubert [:skyschub]]

Sorry for the delay here. This is a top-1k site in some country, so this is absolutely worth investigating. We can do pretty much everything if we want to, I'll let Tom decide if this is easy-enough to create an intervention for.

Comment 10

[Thomas Wisniewski [:twisniewski]]

I wrote an intervention to alter the TE header, but it's not working. I've tried altering the header for just https://apicm.copaair.com/loyalty/createProfile* or the whole site, to remove the header or change it to or deflate;q=0.5, but the site still gives the same innerText error, and the POST request just seems to hang there. Is there more to the story here, Valentin? I'll attach my patch (I've confirmed the TE header is being changed on the requests).

Comment 11

[Thomas Wisniewski [:twisniewski]]

Attachment: WIP: Bug 1954533 - add an intervention for copaair.com to fix broken sign-up process by rewriting TE request header

Comment 12

[Valentin Gosu [:valentin]]

Thanks for the patch Tom. I've looked into it, and came across these comments in mozilla::net::Http2Compressor::EncodeHeaderBlock and mozilla::net::nsHttpTransaction::OnActivated
It seems "TE" is the one header that we can't clear using this code.

Comment 13

[Valentin Gosu [:valentin]]

There are two workarounds for this issue:

1. Disable HTTP/2 support via network.http.http2.enabled = false
2. Setting nsIHttpChannelInternal::allowSpdy to false on the channel. Unfortunately I don't think we can do this via the webextension API, so it seems unlikely we can ship an intervention for it.

Comment 14

[Thomas Wisniewski [:twisniewski]]

Yes, realistically we're stuck here as far as interventions go. Ideally we either add a per-site pref to force specific origins/match-patterns to not use http2, or change the code Valentin found in comment 12 to allow at least the webcompat addon to alter that header. Either will require Gecko changes that our webcompat addon can't do on its own.

Comment 15

[Valentin Gosu [:valentin]]

I've called support and they've instructed me how to file a ticket on the website.
Now waiting for a reply:
Case Number: 3263049
Estimated response time: a maximum of 15 days.

Comment 16

[Valentin Gosu [:valentin]]

First reply:

We could not validate bugs or errors during the registration process using Firefox. We will notify our web support team for further validation.

Comment 17

[Jeff Muizelaar [:jrmuizel]]

Valentin, do we understand why this isn't happening in Chrome?

Comment 18

[Valentin Gosu [:valentin]]

Because they don't set the TE: trailers header - presumably because they don't support any trailers:
https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Trailer
https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Server-Timing

Comment 19

[Thomas Wisniewski [:twisniewski]]

I wonder.. could we make it possible just for addons (or even only the webcompat addon) to remove/change the TE header (and any other such unforgeable headers within reason)? It might be worth doing so, in case we run into other cases where a site isn't as responsive.

Comment 20

[Valentin Gosu [:valentin]]

I posted a patch on bug 1971725 to allow stripping the TE headers.
I think this is the only such header that we couldn't normally overwrite. The first revision will not set the TE: trailers header if the requestHead contains "te": "moz_no_te_trailers":

channel.setRequestHeader("TE", "moz_no_te_trailers", false);

Comment 21

[Thomas Wisniewski [:twisniewski]]

Attachment: Bug 1954533 - add a webcompat intervention for copaair.com to fix broken sign-up process by removing TE request header; r?denschub

Comment 22

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/0c0732488780
https://hg.mozilla.org/integration/autoland/rev/9395d0d8088c
add a webcompat intervention for copaair.com to fix broken sign-up process by removing TE request header; r=denschub,webcompat-reviewers

Comment 23

[Cristian Tuns]

https://hg.mozilla.org/mozilla-central/rev/9395d0d8088c

Comment 24

[Thomas Wisniewski [:twisniewski]]

The site seems to have fixed this now, so I'll remove the intervention.

Comment 25

[Thomas Wisniewski [:twisniewski]]

Attachment: Bug 1954533 - remove our UA override for copaair.com; r?denschub

Comment 26

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/53af6b2c3972
https://hg.mozilla.org/integration/autoland/rev/26171d9adac6
remove our UA override for copaair.com; r=denschub,webcompat-reviewers

Comment 27

[amarc]

https://hg.mozilla.org/mozilla-central/rev/26171d9adac6

Comment 28

[Calin Tanase]

Attachment: RC 142 build 1.png

Verified, the issue is still reproducible with the RC build.

Tested with:

• Browser / Version: Firefox 142.0-candidate build 1
• Operating System: Windows 10

Comment 29

[Valentin Gosu [:valentin]]

Thomas, maybe (In reply to Thomas Wisniewski [:twisniewski][PTO August 18-22] from comment #24)

The site seems to have fixed this now, so I'll remove the intervention.

Was the site not actually fixed, or maybe they rolled back the fix?
Should we reland the intervention?

Comment 30

[Thomas Wisniewski [:twisniewski]]

Yes, it looks like they must have changed their site back to the version broken in Firefox. I'll re-ship the intervention ASAP.

Comment 31

[Thomas Wisniewski [:twisniewski]]

Attachment: Bug 1954533 - re-add our webcompat intervention for copaair.com to fix broken sign-up process by removing TE request header; r?denschub

Comment 32

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/1b31d202df29
https://hg.mozilla.org/integration/autoland/rev/48e9e610579a
re-add our webcompat intervention for copaair.com to fix broken sign-up process by removing TE request header; r=denschub,webcompat-reviewers

Comment 33

[amarc]

https://hg.mozilla.org/mozilla-central/rev/48e9e610579a

Comment 34

[Raul Bucata]

This seems fixed, leaving open since there is an intervention in place.