864663 - CSRF failure on stage after confirming PIN to make a purchase

Status: RESOLVED FIXED

(Marketplace Graveyard :: Payments/Refunds, defect, P1)

Description

[Kumar McMillan [:kumar]]

Attachment: csrf-http.log

STR
- purchase app
- enter new email
- enter PIN
- confirm PIN

This doesn't happen after flashing and does not always happen. Attached is a log that shows HTTP requests/responses

Comment 1

[Kumar McMillan [:kumar]]

This is on stage only

Comment 2

[Kumar McMillan [:kumar]]

Attachment: csrf-http2.log

Comment 3

[Kumar McMillan [:kumar]]

Attachment: screenshot.png

Comment 4

[Kumar McMillan [:kumar]]

New evidence: this happens in relation to specific persona emails. David kept seeing a CSRF even after re-flashing. When he switched persona emails it worked. I added a new http log with his failure.

Comment 6

[krupa raj[:krupa]]

andy, please don't hate me :)

Comment 7

[Wil Clouser [:clouserw]]

How often do you see this?  Any more you can tell us?

Comment 8

[David Bialer [:dbialer]]

pretty often.  Happened to me about 5 times yesterday.  Kumar reflashed my phone and I needed to create a new persona account to fix.  Happened also to others.  So this is a very high priority.  If there are further logs we can capture here, let us know.

Comment 9

[Steve Ruston]

I have rebooted my phone and still had this problem

Comment 10

[Kumar McMillan [:kumar]]

We've only ever seen this on the stage site and I can't find any problem with the HTML form. Perhaps one machine in the server cluster isn't set up for sessions right or something like that. At first we thought it was related to specific persona accounts but that may not be true.

Comment 11

[Wil Clouser [:clouserw]]

Sessions are all cookie based now.  If you have something you want to test specifically let's CC Jason, I'm just not sure what to ask him based on comment 10

Comment 12

[Kumar McMillan [:kumar]]

they aren't cookie based on webpay. They're still memcache in webpay which I think is the reason why it's failing on stage (more nodes). Jason and I are looking at it.

Comment 13

[Kumar McMillan [:kumar]]

thanks jason! From IRC, this was the issue:

jason: for stage we have two memcached hosts
jason: one of the memcached nodes kept restarting the memcached service

Comment 14

[Kumar McMillan [:kumar]]

cookie sessions (bug 871850) should prevent this from happening in the future