701507 - Logging in with browserID fails with 401 status

Status: VERIFIED FIXED

(addons.mozilla.org Graveyard :: Public Pages, defect)

Description

[krupa raj[:krupa]]

steps to reproduce:
1. Load https://addons-dev.allizom.org/en-US/firefox/users/login?to=%2Fen-US%2Ffirefox%2F
2. Log in using BrowserID.

expected behavior:
log in is successful

actual behavior:
logging in fails with "BrowserID login failed. Maybe you don't have an account under that email address? textStatus: error errorThrown: UNAUTHORIZED"

headers:
https://apps-preview-dev.allizom.org/en-US/firefox/users/browserid-login



POST /en-US/firefox/users/browserid-login HTTP/1.1

Host: apps-preview-dev.allizom.org

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:8.0) Gecko/20100101 Firefox/8.0

Accept: */*

Accept-Language: en-us,en;q=0.5

Accept-Encoding: gzip, deflate

Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7

Connection: keep-alive

Content-Type: application/x-www-form-urlencoded; charset=UTF-8

X-Requested-With: XMLHttpRequest

Referer: https://apps-preview-dev.allizom.org/en-US/firefox/users/login

Content-Length: 1193

Cookie: anoncsrf=caa45f63f4493d01ca804322627624b3; sessionid=f4c4318c11fe0bd4ab0828adf9e85bfb

Pragma: no-cache

Cache-Control: no-cache

audience=apps-preview-dev.allizom.org&assertion=eyJjZXJ0aWZpY2F0ZXMiOlsiZXlKaGJHY2lPaUpTVXpFeU9DSjkuZXlKcGMzTWlPaUppY205M2MyVnlhV1F1YjNKbklpd2laWGh3SWpveE16SXhNRFEyTURRMk5ETTVMQ0p3ZFdKc2FXTXRhMlY1SWpwN0ltRnNaMjl5YVhSb2JTSTZJbEpUSWl3aWJpSTZJalE1TWpBeE5EQTBNVEkwTnpJM09ETTJNekV3TnpJME9ESXpOamt5TURFNU56TXpPVGcxTnpjeU5UWTROREUyTlRJMk9UYzROelk0TnpreE56STJOVEV4TURrNU56UXdNRGc0TVRBMU5EVTRNVGd6T1RReU1EYzJOekEwT1RReE1qUTNNemsxTkRBM01qUTVOVEF6TkRNd09EZ3hOemMzT0RreE5UY3pOelUwTnpZMU16azROemszTURneU16Y3lNamN6T0RnME5qRXdNemtpTENKbElqb2lOalUxTXpjaWZTd2ljSEpwYm1OcGNHRnNJanA3SW1WdFlXbHNJam9pYTNKMWNHRXViVzk2WW5WbmMwQm5iV0ZwYkM1amIyMGlmWDAueXo2LWpWVEFFMzJnemRJbEJlTlQ3V291ZDc1bmoycFpBZXRtQVlFMWRyekd5WDc4eUs0R3NaUF9WeVpnVUpVWVFXbC1YRU03d0pvRHc2c0d5NmZpYllPUnYzNXdsN01OVFJGMFp0aXppbFNDZm96czFmc1NacjRPVl9tcmF6NzF2cV9Ec05Td0hnOENEb0dMYlc1dWxQZnNZRXJ2TXNCZEo5bEV0VXB4dm9vIl0sImFzc2VydGlvbiI6ImV5SmhiR2NpT2lKU1V6WTBJbjAuZXlKbGVIQWlPakV6TWpBNU5qQXdNekE1TVRBc0ltRjFaQ0k2SW1oMGRIQnpPaTh2WVhCd2N5MXdjbVYyYVdWM0xXUmxkaTVoYkd4cGVtOXRMbTl5WnlKOS5RMWg3MlZHWGZ1RVNGUjYwU05RTEptQ1JYdUhKZHpUcnBOa1kxNlNUV1paand2SEhuejJJd1BFUXV1RWlXUVNrMS1teVQyWEZrV1QwN3VEVEVoNHN3QSJ9&csrfmiddlewaretoken=84325735a02aa413beebc2135eedc9b2

HTTP/1.1 401 UNAUTHORIZED

Server: Apache

Vary: Cookie,X-Mobile

X-Backend-Server: dev1

Cache-Control: no-cache

Content-Type: text/html; charset=utf-8

Strict-Transport-Security: max-age=2592000

Date: Thu, 10 Nov 2011 21:18:32 GMT

Keep-Alive: timeout=5, max=1000

x-content-security-policy-report-only: policy-uri /services/csp/policy?build=5858

Via: Moz-Cache-pp-zlb01

Connection: Keep-Alive

Set-Cookie: anoncsrf=caa45f63f4493d01ca804322627624b3; expires=Thu, 10-Nov-2011 23:18:32 GMT; httponly; Max-Age=7200; Path=/; secure

Set-Cookie: multidb_pin_writes=y; expires=Thu, 10-Nov-2011 21:18:47 GMT; Max-Age=15; Path=/

x-frame-options: DENY

Content-Length: 0

Comment 1

[Ben Adida [:benadida]]

we need more info on the BrowserID front as to where the error is happening. Are you getting a failed verification from the verifier? Something else?

Comment 2

[krupa raj[:krupa]]

The same bug can be seen both at addons-dev and apps-preview-dev.

headers for -dev is available at http://pastebin.mozilla.org/1379526

Comment 3

[Bill Walker [:bwalker] [@wfwalker]]

Mike Hanson says:

I captured the browserID assertion from https://apps-preview-dev.allizom.org/en-US/firefox/users/login and manually sent it to https://browserid.org/verify with an audience of "https://apps-preview-dev.allizom.org" - the verifier returned success immediately. I suspect the audience being sent by zamboni is incorrect?

Comment 4

[Wil Clouser [:clouserw]]

the browserid folks pushed changes today that caused/fixed this.  -> fixed

Comment 5

[krupa raj[:krupa]]

logging in works now.