715723 - browserid: Signing into MDN takes you away from the page you were at

Status: VERIFIED FIXED

(developer.mozilla.org Graveyard :: Wiki pages, defect)

Description

[Jeff Muizelaar [:jrmuizel]]

STR:

- Goto https://developer.mozilla.org/en/Debugging_Safari
- Click "Sign in".
- Sign in using browser id
- End up here: https://developer.mozilla.org/en-US/users/login

Comment 1

[raymond [:retornam] (inactive)]

screencast http://screencast.com/t/5aEkmkEgVUD

Comment 2

[raymond [:retornam] (inactive)]

Luke this is related to what we discussed on IRC

Comment 3

[Luke Crouch [:groovecoder]]

Craig, is there any way to do the browserid pop-up with the post to /users/browserid_verify on the deki skin header the same way we do on the django header?

Comment 4

[Luke Crouch [:groovecoder]]

Few things have to happen:

* Bypass CSRF for browserid_verify
* Add browserid javascript to MT skin
** Only for en locale

Comment 6

[Les Orchard [:lorchard]]

Bypassing CSRF for browserid_verify: https://github.com/mozilla/kuma/pull/90

Comment 7

[[github robot]]

Commits pushed to https://github.com/mozilla/kuma

https://github.com/mozilla/kuma/commit/1893f195045effe7f05c5d5be568b4ea87bd8ce9
bug 715723: Make the browserid verification form exempt from CSRF protection

https://github.com/mozilla/kuma/commit/edb99c36ff8e72d09fa5700101ea1cb9095d609e
Merge pull request #90 from lmorchard/bug-715723

Bug 715723 - Make the BrowserID verification form exempt from CSRF protection

Comment 8

[Craig Cook (:craigcook)]

I've done the initial integration of BrowserID into the skin in r100272 but it now needs to be wired into our django authentication, and the info dropdown needs to be cookied so it's only shown to first-timers (and it should read the same cookie we're setting on the django site). So alas, I've done about all I can do and must hand off to Luke now to actually make it work.

Comment 9

[Luke Crouch [:groovecoder]]

Attachment: svn diff from skins/mdn

Comment 10

[Craig Cook (:craigcook)]

Diff applied in r100284

Comment 12

[Luke Crouch [:groovecoder]]

Need to address a potential CSRF scenario.

Comment 13

[[github robot]]

Commits pushed to mdn at https://github.com/mozilla/kuma

https://github.com/mozilla/kuma/commit/62eea07e34b0953c3bb7cd3a2ad095f22bcffcd6
Fix Bug 715723 theoretical csrf vulnerability

https://github.com/mozilla/kuma/commit/e957269a07f030bf0f967681ebd6656fea413beb
Merge pull request #100 from groovecoder/bug-715723

Bug 715723

Comment 14

[raymond [:retornam] (inactive)]

qa-verified-stage9 https://developer-stage9.mozilla.org/en/HTML

Comment 15

[raymond [:retornam] (inactive)]

verified fixed https://developer.mozilla.org/en/Debugging_Safari