794624 - Facebook app pages redirecting to mothership on IE9

Status: VERIFIED FIXED

(Firefox Affiliates Graveyard :: Social Integration, defect)

Description

[Osmose [:osmose, :mkelly]]

Steps to reproduce:

1. Visit https://apps.facebook.com/fxaffiliates and auth the app if needed.
2. Observe the landing page appearing correctly.
3. Click a link to another part of the site, such as creating a new banner.

Expected: Create banner page appears.

Actual: User is redirected to the Affiliates homepage, which cannot be shown in a frame and causes IE to show an error message saying as much.

Comment 1

[Osmose [:osmose, :mkelly]]

So I'm thinking this is most likely because the session cookies aren't being set because they're third-party cookies. We probably have to send P3P headers to satisfy IE: http://stackoverflow.com/questions/98127/accessing-domain-cookies-within-an-iframe-on-internet-explorer

Comment 2

[Ben (:bensternthal)]

Not sure if this is a red herring but I looked at the response headers... and i do see xframe-deny. Note this only appears when looking at IE, if I look at this in chrome or FF i do not see this. Adding screenshots.

Comment 3

[Ben (:bensternthal)]

Attachment: page loads ok

Comment 4

[Ben (:bensternthal)]

Attachment: blocked page

Comment 5

[Osmose [:osmose, :mkelly]]

Ben: Note the Location: https://affiliates.mozilla.org/en-US. That's the main page of the mothership, which it shouldn't be redirecting to. It's expected that that page has X-Frame-Options: Deny.

Comment 6

[Osmose [:osmose, :mkelly]]

I've done a bit more work and testing around this, and can confirm that adding P3P headers fixes the core issue. 

ben: Can you check with privacy to see if we already have a set of P3P headers that matches our privacy policy? Otherwise, we'll have to create our own and see if privacy would be willing to review it to confirm that it matches.

Comment 7

[Ben (:bensternthal)]

emailed stacy (currently pto) and alina. will check back in a few days if we do not hear back.

Comment 8

[Tom Lowenthal]

Stacy passed this over to me.

I really don't think that we should implement an actual P3P policy for this. P3P is essentially obsolete, and there's always the risk that we might make a change and forget to update the compact policy.

Instead, I would suggest using a nonsense header, which is a common workaround. Google uses `P3P: CP="This is not a P3P policy!"` and a link to a help page. That would probably work fine for our purposes; If you want to write a SUMO page and add that link to the header too, no problem.

Comment 9

[[github robot]]

Commit pushed to develop at https://github.com/mozilla/affiliates

https://github.com/mozilla/affiliates/commit/83c31e5ce663fc535e0373085f47652f411f6da1
Fix Bug 794624: Add P3P headers to appease IE.

Comment 10

[Tom Lowenthal]

Sorry about this! Further input indicates that the not-a-policy should be "Mozilla's privacy practices are described at https://mozilla.org/privacy". If you want, I can issue a pull request for the change =]

Comment 11

[Osmose [:osmose, :mkelly]]

(In reply to Tom Lowenthal [:StrangeCharm] from comment #10)
> Sorry about this! Further input indicates that the not-a-policy should be
> "Mozilla's privacy practices are described at https://mozilla.org/privacy".
> If you want, I can issue a pull request for the change =]

No problem, I'll make the change tomorrow.

Comment 12

[[github robot]]

Commit pushed to develop at https://github.com/mozilla/affiliates

https://github.com/mozilla/affiliates/commit/004b4e3a4ed09f48baeba0eb2d4ee794bcd0eb6d
Fix Bug 794624: Update P3P policy to point to privacy policy.

Comment 13

[Bob Silverberg [:bsilverberg]]

Verified fixed in IE9 on OS X.

Comment 14

[Osmose [:osmose, :mkelly]]

Marking verified as per #13, thanks!