593953 - Trying to register on the Addons page results in an error message

Status: RESOLVED WORKSFORME

(addons.mozilla.org Graveyard :: Administration, defect)

Description

[nocibambi]

User-Agent:       Mozilla/5.0 (Windows NT 5.1; rv:2.0b4) Gecko/20100818 Firefox/4.0b4 (.NET CLR 3.5.30729)
Build Identifier: https://addons.mozilla.org/en-US/firefox/users/register

The error message is:

Forbidden (403)

CSRF verification failed. Request aborted.

More information is available with DEBUG=True.


Reproducible: Always

Steps to Reproduce:
1. clicking on the register button anywhere on the addons page
2. filling out the form and the captcha
3. clicking on 'register' button
Actual Results:  
I've got the error message.

Expected Results:  
To have been regsitered

Asus M6, WinXP,

Comment 1

[Boris Zbarsky [:bzbarsky]]

Is this a core bug?  Or a bug with the page?  That is, is this broken in all browsers, or just in a particular Firefox build?

Comment 2

[nocibambi]

I think it's related to the page (and maybe to my browser)

I use firefox 4 beta 4
addons:
ablock plus
atomate and poyozo
babelfish
bynamite
download statusbar
feedback
feedly
java quick starter
tab mix plus
WOT

Comment 3

[Boris Zbarsky [:bzbarsky]]

OK, moving to the right place then.

Comment 4

[Wil Clouser [:clouserw]]

Are you sending the referrer header?

Comment 5

[Jeff Balogh (:jbalogh)]

The pref in about:config is network.http.SendRefererHeader

Comment 6

[nocibambi]

it's set to status: user set, type: integer, value: 0

should I change it?

Comment 7

[Wil Clouser [:clouserw]]

If you want to register on AMO, you need to send the referrer header.  I'd guess one of your add-ons turned it off.

Comment 8

[nocibambi]

It was that, however I do not know what caused it.

I disabled my extensions, but the setting did not change. After I turned it on manually I could normally register.

Many thanks.

Comment 9

[Justin Scott [:fligtar]]

We should have a more understandable error message if the referrer is required.

It seems like we should allow registration as long as the referrer isn't some other site (allowing both AMO and missing referrers).

Comment 10

[Wil Clouser [:clouserw]]

Django requires the referrer for it's non-standard CSRF protection.  I agree it's dumb.

I don't know if we can adjust the message easily, but please file a new bug for it if you want to as it's a generic message for all forms on the site.