643710 - Could not log in to ČSOB Internet Banking 24 (ib24.csob.cz)

Status: RESOLVED DUPLICATE of bug 579846

(Core :: Networking: HTTP, defect)

Description

[Honza Bambas (:mayhemer)]

Reproducible with Fx4 RC2 on:
- my WinXP laptop and Win7 machine
- on XP with my regular very old profile and a clean profile
- on 7 only with my clean profile BUT NOT with a regular one

This didn't work with version from Mar 16th, cannot say more at the moment.

STR:
- clean profile
- open the URL
- enter valid login credentials and confirm
-> you are logged in
- log out from the ib24 service
- restart firefox
- open URL again
- enter valid login credentials and confirm
-> you are returned back to the login page, not logged in to the ib24 service, no error indicated by the ib24 service (=the bug)
- repeating again gives the same results, could not log in

When I delete the Cache directory, it works for me again, but just ones.

I will provide logs for case of a successful load and two failed loads.

Comment 1

[Honza Bambas (:mayhemer)]

More bad news:
- verified this is not ISP specific, also going through my mobile provider connection gives the same result
- verified this WORKS in Fx3.6 (.12)

Comment 2

[Honza Bambas (:mayhemer)]

Dropping the blocking flag, based on following:

- this bug is present for a very long time (somewhere between b4 and b8, I'm just narrowing down)
- no one ever found this bug since that time, what may be because:
  1. a recent update to ib24 portal
  2. it doesn't happen that often with existing profiles
  3. the site is not that widely used, so we don't have to bother that much

I have contacted my bank's help desk, we'll see if we get more info from them.

Comment 3

[Honza Bambas (:mayhemer)]

Narrowed far down between these two, this goes far to a5pre version (yet called 3.7):

http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=83c887dff0da&tochange=d6bb0f9e9519

First reproducible with nightly where html5 parser is enabled by default.  This rarely (in <5% of cases) works even w/o the workaround bellow on the first try.

I don't understand why this problem appeared on my machine first today morning.  If CSOB doesn't fix this them self, then I'll try to figure out a fix for this.

---------------------------------------

Workaround to make login work again:

- switch html5.enable to false
- delete cache

Comment 4

[Honza Bambas (:mayhemer)]

This is duplicate of bug 579846.  I can see that index page of the portal is loaded from the cache on the second load when (and only) html5 parser is enabled - nsHTTPChannel::CheckCache exit [doValidation=0].

There are 
    <meta http-equiv="cache-control" content="no-cache" />
    <meta http-equiv="cache-control" content="no-store" />
in the index page.

Ignoring these apparently breaks the authorization process.

This might also be supported by fact that I discovered this bug so late.  The entry expiration time is calculated to be in next two days.  I can say I always, before March 22, visited the portal later then in two days.

Complexity of the site authorization process doesn't let me to check if we can fix this somehow simpler then with patch for bug 579846, that fixes this problem for me.

So far I don't understand why this is not reproducible until Firefox is restarted.  Understanding could help find potential simpler solution.

I'll let the help desk know they have to add the Cache-control header.

Comment 5

[Henri Sivonen (:hsivonen)]

(In reply to comment #3)
> Workaround to make login work again:
> 
> - switch html5.enable to false
> - delete cache

FWIW, with the landing of bug 629621, I expect the workaround no longer to work on trunk.

Comment 6

[Honza Bambas (:mayhemer)]

(In reply to comment #5)
> FWIW, with the landing of bug 629621, I expect the workaround no longer to work
> on trunk.

Confirmed, the workaround from comment 3 doesn't work on the current trunk.

Comment 7

[Yuhong Bao]

So what to do now? Should bug 629621 be reopened?

Comment 8

[Yuhong Bao]

Sorry, bug 579846.

Comment 9

[Boris Zbarsky [:bzbarsky]]

No, this needs to be fixed on the site's end....