206201 - Repeated re-login requests from Pay Pal despite enabling of cookies

Status: VERIFIED INVALID

(Core :: Networking: Cookies, defect)

Description

[mnagyspam]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.4b) Gecko/20030507
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.4b) Gecko/20030507

Attempts to make purchases from AgileOS.com through a PayPal account appear to
work until the screen with the "Pay" button under the address selection radio
buttons appears; then pressing the "Pay" button only results in a "You must log
in" page, and repeated attepmpts to do so only return the exact same page as if
nothing had happened. Note: this isn't broken in Mozilla 1.3.1, only 1.4b, so I
don't think it's just another manifestation of one of the old cookie bugs, or a
procedural error on my part.

Reproducible: Always

Steps to Reproduce:
1. You may have to have a Pay Pal account for this; see https://www.paypal.com
2. Go to http://agileos.com/ with cookies enabled.
3. Elect do donate a dollar to Debian, or make a purchase of your choice.
4. Click "Checkout" at the bottom of the page.
5. Click "Paypal Checkout" on the next page.
6. Enter your "PayPal Login" information and click "Continue".
7. Click the "Pay" button at the bottom of the confirmation page.
8. You will get another login page.  Try to log in.
9. While (not sick of this yet) go to step 8.
10.  If you use Mozilla 1.3.1 instead of 1.4b, with the same settings, the
donation/purchase will be successful; the login loop will not occur.
Actual Results:  
The Pay Pal login page kept appearing over and over

Expected Results:  
The login should have been accepted, as was the case with Mozilla 1.3.1

Comment 1

[[e-mail]]

hmm, i'd rather not try to repro this since i have no particular desire to give
multiple dollars to random people ;)

reporter: please do the following:

1) check your cookie & javascript prefs:
Edit->Prefs->Privacy & Security->Cookies
Edit->Prefs->Advanced->Scripts & Plugins->Create or change cookies/Read cookies

2) if those look okay, please generate a cookie log for the login attempts.
instructions for windows can be found at:

http://bugzilla.mozilla.org/show_bug.cgi?id=193951#c1

the idea is the same for linux. thx!

Comment 2

[mnagyspam]

Attachment: Requested Cookie Log Showing Problem

Comment 3

[mnagyspam]

It looks like somehow the cookie was blocked in my settings even though I'm
using the same ~/.mozilla directory for versions 1.3.1 and 1.4b as far as I
know, and 1.3.1 allowed the transaction.  I "removed all cookie sites" in 1.4b
and it worked this time, so it was at least partly my mistake, but I don't know
how to account for the fact that it was working all along in 1.3.1 while it was
failing in 1.4b (problem with being only a user and not in on the details of how
these things are or should be handled internally).

Comment 4

[[e-mail]]

our treatment of blocked cookie sites has changed between 1.3.1 and 1.4b -
previously, an entry for e.g. paypal.com would only block cookies from that
exact domain (paypal.com), and not for subdomains such as www.paypal.com. we now
block the domain and its subdomains. this is probably what you're seeing, since
the cookies are for www.paypal.com and you most likely had a blocking entry for
just paypal.com.

we believe this is more logical behavior, but it can easily cause confusion if
you're expecting things to continue working. ;)

-> invalid

Comment 5

[benc]

VERIFED: invalid.