430538 - Third-party cookie-blocking breaks auth-required XPI downloads

Status: RESOLVED DUPLICATE of bug 462739

(Core Graveyard :: Installer: XPInstall Engine, defect)

Description

[Todd Agulnick]

If a site hosting an XPI requires that a user present a cookie before downloading, installation fails if the user has disabled third-party cookies.

Specifically, if a site hosts a page that contains a link to a script that checks the user's cookie before returning the XPI, installation fails in the second phase. In the first phase, the user clicks on the link, and everything is good: the site's cookie is sent to the script because the originating uri is the page's uri, and its domain matches that of the cookie.

When Firefox sees the XPI being downloaded, the extension manager steps in to issue its warning. If the user confirms that he really wants to do the download (by allowing the site), Firefox issues another download request, but this time there is no originating uri. The cookie is thus not sent and the download fails with error -207.

This fails on the Foxmarks beta site (http://beta.foxmarks.com/)

Comment 1

[Boris Zbarsky [:bzbarsky]]

Looks like this got fixed in bug 462739, right?

Comment 2

[Dave Townsend [:mossop]]

Yeah it's the same issue.