Open Bug 2042802 Opened 4 months ago Updated 1 month ago

signin.costco.com - Login fails

Categories

(Web Compatibility :: Site Reports, defect, P1)

Product:
Web Compatibility
Component:
Site Reports
Platform:
Desktop
Windows 10
Type:
defect

Tracking

(Webcompat Priority:P1, Webcompat Score:8, firefox151 affected, firefox152 affected, firefox153 affected)

Project Flags:
Webcompat Priority P1
Webcompat Score 8
Tracking Flags:
Tracking Status
firefox151 --- affected
firefox152 --- affected
firefox153 --- affected

People

(Reporter: rbucata, Unassigned)

References

(
URL
)

Details

(Keywords: webcompat:needs-diagnosis, webcompat:site-report, Whiteboard: [webcompat-source:web-bugs][autowebcompat:processed][autowebcompat:repro-success])

User Story

platform:windows,mac,linux,android
impact:workflow-broken
configuration:general
affects:all
branch:release
diagnosis-team:networking
user-impact-score:800
autowebcompat-repro-status:success
autowebcompat-repro-chrome-mask-fixed:false
autowebcompat-repro-channels:stable
autowebcompat-diagnosis-status:failed
autowebcompat-diagnosis-reason:not_firefox_specific

Attachments

(2 files)

Chr vs FF
371.02 KB, video/mp4
Details
Reproduction steps generated by autowebcompat bot
1.65 KB, text/markdown
Details

Environment:
Operating system: Windows 10
Firefox version: Firefox 151.0

Preconditions:

  • VPN set to the US

Steps to reproduce:

  1. Navigate to: https://signin.costco.com/e0714dd4-784d-46d6-a278-3e29553483eb/B2C_1A_SSO_WCS_signup_signin_209/oauth2/v2.0/authorize?ClientName=USBC&ui_locales=en-US&scope=openid+offline_access&response_type=code+id_token&redirect_uri=https%3A%2F%2Fwww.costco.com%2FOAuthLogonCmd&state=guestUserId%3D-1002%26DM_PersistentCookieCreated%3Dtrue%26URL%3D%5BSSO%5D%2F%5BSSO%5D&nonce=CikYM6ODG4TCe2z9&client_id=4900eb1f-0c10-4bd9-99c3-c59e6c1ecebf&TC=0&response_mode=form_post
  2. Enter valid credentials
  3. Click on the sign in button and observe

Expected Behavior:
Login is performed

Actual Behavior:
Page reloads

Notes:

  • Reproduces regardless of the status of ETP
  • Reproduces in firefox-release
  • Does not reproduce in firefox-nightly, and chrome

Created from https://github.com/webcompat/web-bugs/issues/222480

status-firefox151: --- → affected
status-firefox153: --- → unaffected
Attached video Chr vs FF —

Since nightly and release are affected, beta will likely be affected too.
For more information, please visit BugBot documentation.

status-firefox152: --- → affected
Severity: -- → S2
User Story: (updated)
Webcompat Priority: --- → P1
Webcompat Score: --- → 8
Keywords: webcompat:needs-diagnosis
Priority: -- → P1
See Also: → 1931287

I was able to log into costco, using a new Firefox profile, by going directly to the costco main page.

  • Opened alternate profile from about:profiles (also on Nightly)
  • enabled VPN to US (nordVPN)
  • loaded costco.com
  • Clicked log in
  • entered user name and password.
  • Login worked

Unclear why the XHR request to log in fails with a 403.

Whiteboard: [webcompat-source:web-bugs] → [webcompat-source:web-bugs][autowebcompat:processed]
User Story: (updated)
Whiteboard: [webcompat-source:web-bugs][autowebcompat:processed] → [webcompat-source:web-bugs][autowebcompat:processed][autowebcompat:repro-success][autowebcompat:diagnose]

In Firefox, submitting the Costco sign-in form does nothing: the credential POST to .../SelfAsserted is answered with an Akamai "Access Denied" 403, so no validation message or redirect ever appears. Chrome behaves identically — the same endpoint returns the same Akamai 403 HTML with an _abck=...-1 (unvalidated) cookie. The block appears to be Akamai bot management rejecting this environment rather than anything Firefox-specific.

Whiteboard: [webcompat-source:web-bugs][autowebcompat:processed][autowebcompat:repro-success][autowebcompat:diagnose] → [webcompat-source:web-bugs][autowebcompat:processed][autowebcompat:repro-success][autowebcompat:diagnosis-in-progress]
User Story: (updated)
Whiteboard: [webcompat-source:web-bugs][autowebcompat:processed][autowebcompat:repro-success][autowebcompat:diagnosis-in-progress] → [webcompat-source:web-bugs][autowebcompat:processed][autowebcompat:repro-success]
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: