2048209 - Custom scheme OAuth flow should only be used when this instance is the handler

Status: VERIFIED FIXED

(Thunderbird :: Account Manager, defect, P1)

Description

[Ramona Gavrilescu]

Attachment: Screenshot 2026-06-17 at 13.18.59 (1).png

Affected versions


• 153.0b1(20260616175427)
   
  Affected platforms

• macOS 15.5

• macOS 26

• Windows 11

• Windows 10

• Ubuntu 24 

   
  Steps to reproduce

  1.Download TB 153.0b1 from archive
  2.Install TB.
  3.Created a fresh profile and launched TB.
  4.Opened Account hub and entered an email address.
  5.Clicked on Continue button.
  6.Selected IMAP and clicked Continue
  7.The browser opens to sign-in page, entered account password and clicked on Next.
   
  Actual result

• After clicking on Next, the account setup process gets stuck, The browser remains on loading state, as well as the Account hub modal.
   
  Expected result

• The account should be successfully added in TB.

Notes:

• The behaviour is also reproducible on the latest daily.
• Tried this scenario with multiple yahoo accounts, on some the account configuration process gets stuck in loading state, on other when the browser to sign-in page opens a message is displayed "The address wasn't understood. Firefox can't connect to the server api.login.yahoo.com"(check screenshot attached.
• Also update from a previous version to 153.0b1 and the existing logged yahoo accounts were not affected

Comment 1

[Ramona Gavrilescu]

Attachment: Screenshot 2026-06-17 at 11.17.57 AM.png

Comment 2

[Magnus Melin [:mkmelin]]

Does setting mailnews.oauth.useExternalBrowser false make any difference?

Comment 3

[Ramona Gavrilescu]

Hello!
Changed the mailnews.oauth.useExternalBrowser to false and same behaviour is happening, the account setup process gets stuck.

Comment 4

[Ramona Gavrilescu]

Attachment: Screenshot 2026-06-17 at 14.28.33.png

Comment 5

[Vlad Lucaci, Thunderbird QA (:vlucaci)]

Hello,

I searched for a regression range for this issue and got the following pushlog_url : https://hg.mozilla.org/comm-central/pushloghtml?fromchange=eabe2e4b5c24c67b721c2742331c6699f5077178&tochange=8ddf2bf0b16d4ddcdaf420f768381b34f66e992c

The bisection log ended with this information:

2026-06-17T14:43:47.696000: INFO : Narrowed integration regression window from [eabe2e4b, b11ca285] (3 builds) to [eabe2e4b, 8ddf2bf0] (2 builds) (~1 steps left)
2026-06-17T14:43:47.716000: DEBUG : Starting merge handling...
2026-06-17T14:43:47.717000: DEBUG : Using url: https://hg.mozilla.org/comm-central/json-pushes?changeset=8ddf2bf0b16d4ddcdaf420f768381b34f66e992c&full=1
2026-06-17T14:43:47.719000: DEBUG : redo: attempt 1/3
2026-06-17T14:43:47.720000: DEBUG : redo: retry: calling _default_get with args: ('https://hg.mozilla.org/comm-central/json-pushes?changeset=8ddf2bf0b16d4ddcdaf420f768381b34f66e992c&full=1',), kwargs: {}, attempt #1
2026-06-17T14:43:47.724000: DEBUG : urllib3.connectionpool: Resetting dropped connection: hg.mozilla.org
2026-06-17T14:43:48.509000: DEBUG : urllib3.connectionpool: https://hg.mozilla.org:443 "GET /comm-central/json-pushes?changeset=8ddf2bf0b16d4ddcdaf420f768381b34f66e992c&full=1 HTTP/1.1" 302 0
2026-06-17T14:43:49.167000: DEBUG : urllib3.connectionpool: https://hg-edge.mozilla.org:443 "GET /comm-central/json-pushes?changeset=8ddf2bf0b16d4ddcdaf420f768381b34f66e992c&full=1 HTTP/1.1" 200 None
2026-06-17T14:43:49.170000: DEBUG : Found commit message:
Bug 2044545 - add text-brand to design system colors. r=vineet,aleca

Differential Revision: https://phabricator.services.mozilla.com/D304333

2026-06-17T14:43:49.172000: DEBUG : Did not find a branch, checking all integration branches
2026-06-17T14:43:49.172000: INFO : The bisection is done.
2026-06-17T14:43:49.173000: INFO : Stopped

It seems that bug 2043258 caused this regression.

Comment 6

[Magnus Melin [:mkmelin]]

Probably should back out bug 2043258 for now.

Comment 7

[Justin Tracey [:jtracey]]

Thanks for the report. Can you check if the version of Thunderbird you're testing with is configured to handle custom Thunderbird links? Settings -> General -> System integration -> check now -> Custom Thunderbird links. The flow is expected to fail if that's not on, e.g. because you have multiple Thunderbird instances installed and one of the others is currently configured to handle it instead of the one being tested. We maybe should warn the user about this before relying on it.

Comment 8

[Ramona Gavrilescu]

Hello,
Opened Settings -> General -> System integration -> check now -> Custom Thunderbird links, indeed it was not checked, i checked it restarted tb and begin the account setup process, and can confirm the account was added successfully in TB, i noticed that the browser sign-in page still shows loading state.(check screenshot attached)

Comment 9

[Ramona Gavrilescu]

Attachment: Screenshot 2026-06-17 at 15.32.02.png

Comment 10

[Justin Tracey [:jtracey]]

That page looks like a bug on Yahoo's end, not much we can do there.

I'm changing this to track checking if we're the handler (see also this TODO comment). I could go either way on disabling the custom scheme flow in the meantime—on the one hand, it's very confusing for users, on the other, it probably only happens when users have multiple instances of Thunderbird installed, or they expressly opted out of custom protocol handling, both of which are pretty rare (I assume).

Comment 11

[Justin Tracey [:jtracey]]

Attachment: Bug 2048209 - Check we are the default net.thunderbird handler before trying to use it for OAuth. r=#thunderbird-reviewers

Comment 12

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/comm-central/rev/1833e023ad86
Check we are the default net.thunderbird handler before trying to use it for OAuth. r=tobyp,darktrojan

Comment 13

[Justin Tracey [:jtracey]]

Comment on attachment 9598334 [details]
Bug 2048209 - Check we are the default net.thunderbird handler before trying to use it for OAuth. r=#thunderbird-reviewers

Uplift Approval Request

• Please state case for uplift consideration and ensure bug severity is set: Without this patch, Thunderbird can attempt to use net.thunderbird redirect targets for OAuth login, even if it's not configured with the OS to handle them.
• User impact if declined: Attempts to log in on Yahoo accounts, when Thunderbird isn't set as the application to handle net.thunderbird links, will fail.
• Is this code covered by automated tests?: Yes
• Has the fix been verified in Daily?: Yes
• Has the fix been verified in Beta?: N/A
• Needs manual test from QA?: No
• If yes, steps to reproduce:
• List of other uplifts needed: None
• Risk to taking this patch: Medium
• Why is the change risky/not risky? (and alternatives if risky): The code adds a fallback to the old behavior if the OS isn't configured to let Thunderbird handle net.thunderbird links. This should be relatively rare, Thunderbird checks for this at launch by default, and it's only used on Yahoo accounts, but I'm marking risk as "medium" because simply disabling this feature entirely for Yahoo is a less risky alternative (one we've decided to avoid for now).
• Does the fix cause any migrations to be skipped?: No
• String changes made/needed: N/A

Comment 14

[Corey Bryant]

Comment on attachment 9598334 [details]
Bug 2048209 - Check we are the default net.thunderbird handler before trying to use it for OAuth. r=#thunderbird-reviewers

[Triage Comment]
Approved for beta

Comment 15

[Evandro Baginski [:ebaginski]]

Thunderbird 153.0b5:
https://hg.mozilla.org/releases/comm-beta/rev/be259cf402e6

Comment 16

[Ramona Gavrilescu]

Confirming this issue as verified fixed on TB 153.0b5. Tested on macOS Sonoma 15.4.7, Win 11.