901083 - A saved credit card information is available after an account logout (Seahorse)

Status: RESOLVED WORKSFORME

(Marketplace Graveyard :: Payments/Refunds, defect, P1)

Description

[karina.filipe]

Attachment: ezboot-http-ccinfostored.log

User Agent: Mozilla/5.0 (Windows NT 6.1; rv:22.0) Gecko/20100101 Firefox/22.0 (Beta/Release)
Build ID: 20130618035212

Steps to reproduce:

1. Start Marketplace
2. Login with [e-mail] account
3. Seach for a paid app
4. Purchase the app and set the credit card info to be remembered
5. Logout 
6. Login with [e-mail] account
7. Search for a paid app
8. Click to purchase the app



Actual results:

The credit card information was stored after the logout


Expected results:

The credit card information should be set only for the particular account, and a logout should delete the information.

Comment 1

[karina.filipe]

Attachment: 2013-08-02-15-39-52-ccinfostored.png

Comment 2

[Kumar McMillan [:kumar]]

This should not be happening because we request a bango logout and because of user ID handling (bug 880007). However, I do not see an HTTP request in the log. Karina, can you attach a logcat from the device?

Comment 3

[karina.filipe]

Hi Kumar,

Unfortunately, the purchase feature didn't work yesterday or today.
When we see this working again, I'll take logs for you!

Comment 4

[Kumar McMillan [:kumar]]

Keir, while I'm waiting for a log to see if we had a problem calling the Bango logout URL, can you verify that this assumption is correct or not:

- user makes a payment in Seahorse on device
- user saves the credit card
- user logs out and logs in with a new account (this sends Bango a new MOZ_USER_ID)
- Mozilla requests http://bango/logout to clear cookies
- user makes a second payment on the same device
- Bango should not provide access to the stored credit card

Correct?

Comment 5

[karina.filipe]

Attachment: Logcat

Comment 6

[Keir Kettle]

(In reply to Kumar McMillan [:kumar] from comment #4)
> Correct?

Basically correct, although it should be 

- user logs out 
- Mozilla requests http://bango/logout to clear cookies
- user logs in with a new account (this sends Bango a new MOZ_USER_ID)
- user makes a payment on the same device with the new account

Comment 7

[Kumar McMillan [:kumar]]

Karina, it looks like you don't have the console logging activated. Can you double check by going into settings -> device info -> more info -> developer and tick the box for Console Enabled? And capture a new logcat.

Comment 8

[Kumar McMillan [:kumar]]

Per comment #6, as long as Mozilla's pay flow does a Bango logout between two users then the card should be cleared. I verified that the logout is happening:

E/GeckoConsole(  109): Content JS LOG at https://marketplace-cdn.allizom.org/mozpay/media/js/pay-min.js?build=46ac41c-520d269d:4 in anonymous: do bango.logout()
E/GeckoConsole(  109): Content JS LOG at https://marketplace-cdn.allizom.org/mozpay/media/js/pay-min.js?build=46ac41c-520d269d:4 in anonymous: Logging out of Bango
E/GeckoConsole(  109): Content JS LOG at https://marketplace-cdn.allizom.org/mozpay/media/js/pay-min.js?build=46ac41c-520d269d:4 in anonymous: Bango logout responded: 200

Keir, this means Bango is either not clearing the cookie or something else is causing the old Bango ID to going on device. Can you investigate further?

Comment 9

[Kumar McMillan [:kumar]]

Hold up on this. After further analysis I think this is a dupe of bug 888036, the tester here was testing too fast and thus her PIN was unlocked (the unlock window is 5 minutes). Switching users within the unlock window will not trigger a logout until bug 888036 is fixed. Before I dupe it, Krupa is going to confirm this by re-testing tomorrow.

Comment 10

[vinicius.varjao]

Attachment: Credicard_issue.zip

Used a reflashed sample, the credicard data was restored, but when changed the user the same saved CC data was not erased and diplayed again.
This behavior does not occur all the times

Comment 11

[Kumar McMillan [:kumar]]

Hi Vinicius. You must wait at least 5 minutes after switching users when testing for this specific bug. Otherwise, you will encounter bug 888036 which is a separate issue (and is about to be fixed)

Comment 12

[Steve Ruston]

Vinicius, have you retested 5 minutes after switching users? Can you let us know before 5.30pm UK?

Comment 13

[vinicius.varjao]

Hi Steve, I retested it after 5 minutes and the behavior does not occurred, according separete issue discribed by Kumar I think it is the core problem.

Comment 14

[Kumar McMillan [:kumar]]

Thanks. This confirms my hypothesis. This bug is invalid -- you were running into bug 888036 (which is less severe)