871775 - User hits a 403 page after the Create a PIN screen

Status: RESOLVED DUPLICATE of bug 865291

(Marketplace Graveyard :: Consumer Pages, defect)

Description

[krupa raj[:krupa]]

steps to reproduce:
1. Launch marketplace-dev app on your phone
2. Sign in as a new user
3. Start the purchase for a paid app like Private Yacht
4. Enter a 4-digit in the Create a PIN screen
5. Click Continue


expected behavior:
Confirm your PIN screen loads

observed behavior:
403 forbidden screen loads

http request [
POST /mozpay/pin/create HTTP/1.1
Host: marketplace-dev.allizom.org
User-Agent: Mozilla/5.0 (Mobile; rv:18.0) Gecko/18.0 Firefox/18.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://marketplace-dev.allizom.org/mozpay/pin/create
Cookie: webpay_anoncsrf=0PZxDtqUsIkCKRh5XESIUaXxVM1VNAqt; webpay_sessionid=6663329846887ed436e3c314fafdb260
Connection: keep-alive
]
I/PRLog   (  108): 2013-05-13 21:35:05.065211 UTC - 7557072[40404470]: nsHttpTransaction::HandleContentStart [this=4b897260]
Duration:        0.067 4b897260       (marketplace-dev.allizom.org -> POST /mozpay/pin/create)
http response [
HTTP/1.1 403 FORBIDDEN
Server: gunicorn/0.14.6
Vary: Cookie, Accept-Language, Accept-Encoding
Content-Type: text/html; charset=utf-8
Content-Encoding: gzip
Date: Mon, 13 May 2013 21:35:06 GMT
Transfer-Encoding: chunked
Via: Moz-pp-zlb09
Connection: keep-alive
Set-Cookie: webpay_anoncsrf=0PZxDtqUsIkCKRh5XESIUaXxVM1VNAqt; expires=Mon, 13-May-2013 23:35:06 GMT; httponly; Max-Age=7200; Path=/; secure
x-frame-options: DENY
]

Comment 1

[Kumar McMillan [:kumar]]

CSRF relies on memcache and we had memcache trouble in bug 865291. It should be fixed now.