826928 - Unauthorized/forbidden call to /api/whoami because of CSRF on Popcorn Maker's basic-template page

Status: VERIFIED FIXED

(Webmaker Graveyard :: Popcorn Maker, defect)

Description

[Stephen Donner [:stephend] Not actively reading bugmail]

Attachment: Screenshot

Just loading https://popcorn.webmaker.org/templates/basic/ with Firefox, I get in my Web Console:

[17:27:46.727] GET https://popcorn.webmaker.org/api/whoami [HTTP/1.1 403 Forbidden 167ms]

Looking at the response body, I see:

{"error":"unauthorized","csrf":"UOubWcF9Zvktfv6SbApwWupy"}

Comment 1

[Jon Buckley]

Code being reviewed at: https://webmademovies.lighthouseapp.com/projects/65733/tickets/2990-bug-826928-apiwhoami-failing-confuses-people

I'm going to mark this as resolved, since it's a small patch and should land today.

Comment 2

[Stephen Donner [:stephend] Not actively reading bugmail]

(In reply to Jon Buckley [:jbuck] from comment #1)
> Code being reviewed at:
> https://webmademovies.lighthouseapp.com/projects/65733/tickets/2990-bug-
> 826928-apiwhoami-failing-confuses-people
> 
> I'm going to mark this as resolved, since it's a small patch and should land
> today.

Thanks; any idea when this will be pushed live?

Comment 3

[Jon Buckley]

Not sure, but you can test it out on the staging server at http://popcorn.rekambew.org/templates/basic/

Comment 4

[Stephen Donner [:stephend] Not actively reading bugmail]

(In reply to Jon Buckley [:jbuck] from comment #3)
> Not sure, but you can test it out on the staging server at
> http://popcorn.rekambew.org/templates/basic/

Thanks, Jon.  What's your process -- do we mark it verified on staging or production?

Comment 5

[Jon Buckley]

Hm, we don't really have a process for when we mark a bug verified as fixed. What's the standard Mozilla QA procedure? I'd just follow that

Comment 6

[Stephen Donner [:stephend] Not actively reading bugmail]

(In reply to Jon Buckley [:jbuck] from comment #5)
> Hm, we don't really have a process for when we mark a bug verified as fixed.
> What's the standard Mozilla QA procedure? I'd just follow that

No standard, even within Web QA projects -- some groups want Verified on staging, others on production.  I'll wait until it's pushed to production; thanks!

Comment 7

[Jon Buckley]

It's on prod now! Verify away~

Comment 8

[Stephen Donner [:stephend] Not actively reading bugmail]

Verified FIXED; thanks!